Keeping the base current.
WHY IT MATTERS
Kernel vulnerabilities permit privilege escalation, turning a limited compromise into total control.
WHAT A REBOOT IS USUALLY REQUIRED FOR
A new kernel to take effect.
HOW TO SEE WHAT IS RUNNING
uname with the release option.
HOW TO SEE WHAT IS INSTALLED
The package manager's list of kernels.
WHAT A MISMATCH MEANS
An update was installed but not applied.
WHAT LIVE PATCHING PROVIDES
Applying certain kernel fixes without rebooting.
WHAT IT COSTS
A subscription, usually, and it does not cover everything.
WHAT TO DO BEFORE REBOOTING A SERVER
Confirm services are set to start at boot Confirm you have console access if it does not return Schedule it Take a snapshot where possible
WHY CONSOLE ACCESS MATTERS
A machine that fails to boot cannot be reached over the network.
WHAT TO CHECK AFTER
That every expected service is running That sites respond That mounts are present
WHAT TO KEEP
The previous kernel, so you can boot it if the new one misbehaves.
WHAT TO NEVER DO
Reboot a server you cannot reach physically or through a console, without a plan.
WHAT UPTIME OF YEARS ACTUALLY INDICATES
Kernel updates never applied.
