The Linux Kernel Gets Hacked Every Week: Here’s How to Defend Yours (No Fluff)

 

Stop guessing if your Linux kernel is safe. Learn to check, patch, and mitigate Ubuntu / Rocky Linux / SUSE flaws with real commands & automation. Includes emergency workarounds.

One date doesn’t matter. On April 17, 2026, Ubuntu released USN-8188-1 fixing ~70 CVEs in the 5.15 HWE kernel. But next week there will be another. And another.

This isn’t news. It’s routine.

What’s useful is knowing how to react every single time. That’s what this guide is for.

Step 1 – Check If You’re Vulnerable (Right Now)

Run these commands today – they work for any similar kernel alert.

Ubuntu 20.04 / 22.04 LTS

bash

# Check your current kernel
uname -r

# See if your kernel is older than the fixed version
dpkg -l | grep linux-image-5.15.0-176

# Verify if Ubuntu Pro is active (required for this fix)
pro status

Vulnerable if: uname -r shows 5.15.0-175 or lower.

Rocky Linux / AlmaLinux 8, 9

bash

# Show kernel version
uname -r

# List available kernel updates
dnf check-update kernel

# Check if a specific CVE affects you (needs `kernel-abi` tool)
sudo dnf install kernel-abi-stablelists
grep CVE-2026-22997 /usr/share/doc/kernel-abi-stablelists/stablelist

SUSE Linux Enterprise / openSUSE Leap

bash

# Running kernel
uname -r

# See if patch is installed
zypper patches | grep -i kernel

# Search for a specific CVE in changelog
rpm -q --changelog kernel-default | grep CVE-2026-22997

Step 2 – Automation Script to Apply the Fix (Bash, distro-agnostic)

Save this as kernel-update.sh – it works on Ubuntu, Rocky Linux, SUSE.

bash

#!/bin/bash
# Kernel security updater – use after any USN/RHSA/SUSE-SU

set -e

DISTRO=$(grep ^ID= /etc/os-release | cut -d= -f2 | tr -d '"')

echo "=== Linux kernel vulnerability fix ==="

case $DISTRO in
  ubuntu)
    sudo apt update
    sudo apt install --only-upgrade linux-image-generic-hwe-20.04
    ;;
  rhel|rocky|almalinux)
    sudo dnf update kernel -y
    ;;
  suse|opensuse-leap)
    sudo zypper patch --cve=CVE-2026-22997  # replace with actual CVE
    sudo zypper update kernel-default
    ;;
  *)
    echo "Unsupported distro. Check manually."
    exit 1
    ;;
esac

echo "Update applied. Reboot required."
echo "Run: sudo reboot"

Make it executable:

bash

chmod +x kernel-update.sh
sudo ./kernel-update.sh

Step 3 – Can’t Reboot Right Now? Use These Mitigations

If you run a production server that can’t restart for days, block the attack vectors without updating.

Block kernel exploits via iptables (network-based CVEs).

Many of those 70+ flaws affect IPv6, netfilter, SCTP.

bash

# Block SCTP (rarely needed)
sudo iptables -A INPUT -p sctp -j DROP

# Limit IPv6 fragmentation (used in many kernel heap attacks)
sudo ip6tables -A INPUT -f -j DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

AppArmor profile to restrict unprivileged user namespaces (common kernel escape)

bash

# Create a restrictive profile for unprivileged containers
sudo aa-status
echo "deny /proc/*/ns/user r," | sudo tee -a /etc/apparmor.d/tunables/global
sudo systemctl reload apparmor

Disable BPF JIT (BPF CVEs are in this list)

bash

# Temporary until reboot
echo 0 | sudo tee /proc/sys/net/core/bpf_jit_enable

Suggeted reading

The Linux Security Cookbook by Daniel J. Barrett - Amazon

Why this matter?

Contains 50+ real-world recipes for kernel hardening, including how to disable unused network protocols (like SCTP and L2TP from the CVE list) permanently.

Affiliate disclosure: As an Amazon Associate, I earn from qualifying purchases. This helps me keep writing in-depth security guides – at no extra cost to you.)