Ubuntu Kernel Security: The Complete, Lasting Guide (Works for Years)

 

Ubuntu kernel security simplified. Check your kernel, auto-fix with a bash script, and apply firewalls or AppArmor when updates aren't possible. Long-term guard for 22.04 LTS.

Every few months, your Ubuntu server — whether on a Raspberry Pi or a traditional PC — needs a kernel refresh. This guide gives you the tools to check for outdated kernels, apply fixes with a one-liner, and stay protected without rebooting if you absolutely can't.

Historical context: On May 11, 2026, Ubuntu released USN-8180-6 to fix more than 70 kernel vulnerabilities (including CVE‑2026‑23101) in the linux‑raspi kernel for Ubuntu 22.04 LTS. The advice below works for that update and every future kernel security update.

How to Check if Your Kernel Is Vulnerable

Run these three commands — they work on any recent Ubuntu or Debian system. You don't need to understand CVEs or kernel patches beforehand.

1. See the kernel you're actually running

bash

uname -r

Expected output for a non‑vulnerable Raspberry Pi kernel:

5.15.0-1099-raspi or higher (see “Fixed versions” below).

2. List every installed kernel

bash

dpkg -l | grep linux-image

This shows all kernels sitting on disk, including the one you're not currently using. If your running kernel (from step 1) is older than the installed ones, you forgot to reboot after the update.

3. Verify that security updates are available and applied

bash

apt list --upgradable 2>/dev/null | grep linux-image

If this command returns anything, your system is missing kernel security patches.

Fixed kernel versions for USN-8180‑6 (Ubuntu 22.04 LTS):

linux-image-raspi → 5.15.0.1099.97

Automation Script: Apply the Fix in One Command

Save the following script as kernel-secure.sh and run it whenever you see a new Ubuntu kernel security notice. The script checks, updates, and reboots intelligently — no babysitting required.

bash

#!/bin/bash
# kernel-secure.sh – Automatic kernel security hardener for Ubuntu
# No arguments needed. Run with: sudo bash kernel-secure.sh

set -e

echo "=== Ubuntu Kernel Security Hardener ==="
echo "1. Updating package lists..."
apt update -qq

echo "2. Checking for pending kernel updates..."
PENDING=$(apt list --upgradable 2>/dev/null | grep -c linux-image || true)

if [ "$PENDING" -eq "0" ]; then
    echo "✅ No kernel updates pending. Exiting."
    exit 0
fi

echo "⚠️  Kernel update(s) found ($PENDING pending)."

echo "3. Applying all security upgrades (kernel + other packages)..."
apt upgrade -y -qq

echo "4. Checking if reboot is required..."
if [ -f /var/run/reboot-required ]; then
    echo "🔄 Reboot required. The system will restart in 30 seconds."
    echo "   You can cancel by pressing Ctrl+C now."
    sleep 30
    reboot
else
    echo "✅ No reboot needed. All good."
fi

How to use it

bash

chmod +x kernel-secure.sh
sudo ./kernel-secure.sh

You can also set this script to run weekly via cron to catch kernel updates automatically.

The Practical Lab: Why You Should Build a Test Machine

Every serious system administrator needs a place to test kernel updates and security scripts before touching production. The cheapest, most realistic Linux kernel lab is a Raspberry Pi 4 running Ubuntu 22.04 LTS — exactly the target of the advisory above.

👉 Build your kernel‑security lab with the official Raspberry Pi 4 Starter Kit (Amazon affiliate). It includes everything: Pi 4 (4/8 GB RAM), power supply, case, micro‑HDMI cables, and a pre‑flashed SD card.

Get the Raspberry Pi 4 Kit on Amazon ( adversiting )→   https://amzn.to/4uEcQWr

With this kit you can:

• Run the kernel-secure.sh script in a safe environment.

• Test the iptables and sysctl mitigations without breaking anything real.

• Verify that rebooting after a kernel update actually works (something you can't always test in production).

I earn a comission with you make a purchase.

Alternative Mitigations When You Can't Update Right Now

Sometimes you cannot reboot, or the kernel update would break a production workload. These three alternatives reduce the attack surface until you can schedule a proper update.

1. Block kernel‑exploit vectors with iptables

If the vulnerability is network‑reachable (many in this USN are), a strict iptables policy buys you time.

bash

# Drop all incoming traffic except established connections and SSH
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT    # keep SSH open
iptables -A INPUT -i lo -j ACCEPT                # allow localhost
# Save rules so they survive reboot
apt install iptables-persistent -y
netfilter-persistent save

2. Restrict user namespaces (sysctl mitigation)

Many local‑privilege‑escalation vulnerabilities (including several in USN‑8180‑6) require unprivileged user namespaces. Disabling them blocks an entire class of exploits – but may break sandboxed applications like Snap, Docker, and Flatpak.

bash

# Temporary disable (resets after reboot)
sudo sysctl -w kernel.unprivileged_userns_clone=0

# Permanent disable: add to /etc/sysctl.conf
echo "kernel.unprivileged_userns_clone=0" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Test thoroughly: disabling user namespaces will break applications that depend on them, particularly containers and sandboxes

3. Enforce a strict AppArmor profile

Ubuntu ships with AppArmor but default profiles are permissive. You can toggle a restrictive sysctl that blocks unprivileged users from loading or modifying any AppArmor policy.

bash

# Block all unprivileged AppArmor policy changes
sudo sysctl -w kernel.apparmor_restrict_unprivileged_confined=1
sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
# Make permanent
echo "kernel.apparmor_restrict_unprivileged_confined=1" | sudo tee -a /etc/sysctl.conf
echo "kernel.apparmor_restrict_unprivileged_unconfined=0" | sudo tee -a /etc/sysctl.conf

These three layers (network filter, namespace restriction, AppArmor lockdown) together make exploitation drastically harder even if the kernel itself remains unpatched for a few days.

Conclusion 

Don't wait for the next Ubuntu security notice to panic. Bookmark this guide and run the kernel-secure.sh script every month — it will automatically keep your kernel hardened against whatever new CVEs appear.

Better yet: buy a Raspberry Pi 4 lab kit today and practice kernel updates and mitigations twice. Your production servers will thank you when real vulnerabilities inevitably appear.