Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
VGSources
Blog

How to Update the Linux Kernel on Ubuntu Safely (GA, HWE and Livepatch)

Update Ubuntu’s kernel safely with the package manager, reboot into the new version, choose between GA and HWE knowingly, and use Livepatch without mistaking it for a full replacement for ordinary kernel maintenance.
Length9 min Posted Quest giverVGSources Team

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On Ubuntu Desktop or Server, update the kernel through the normal package manager, then reboot into the newly installed kernel. Check the running version with uname -r before and after maintenance. A routine update is:

uname -r
sudo apt update
sudo apt upgrade
sudo reboot
uname -r

The reboot is what actually starts the new kernel. Ubuntu Pro Livepatch can apply supported high- and critical-severity security fixes without an immediate reboot, but it does not replace ordinary kernel package updates or the maintenance reboot required for changes outside Livepatch coverage.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The supported Ubuntu kernel-update path

Ubuntu distributes kernel updates as packages managed by APT. On a normal installation, the installed kernel metapackage keeps the system following the kernel stream selected for that release. Updating the package metadata and installing upgrades therefore handles the kernel in the same transaction as other supported Ubuntu updates.

Canonical’s documented rule is that changes outside Livepatch coverage must be installed with the system package manager: APT on Ubuntu Desktop and Server, or snapd on Ubuntu Core. After the package is installed, the machine must boot the new kernel before it is running it.

What each command does

  • uname -r prints the kernel currently running in memory. It is a runtime check, not a list of every kernel installed on disk.
  • sudo apt update refreshes the local package indexes so APT can see published updates.
  • sudo apt upgrade installs available updates while making the ordinary, conservative dependency changes expected from a routine upgrade.
  • sudo reboot restarts the machine so GRUB can load the newly installed kernel.
  • Running uname -r again confirms which kernel the system actually booted.

Use the distribution’s documented full-upgrade procedure only when dependency changes require it. Do not remove the standard kernel metapackage simply to hold a version; that can stop the installation from receiving future kernel updates.

Before you start: make the reboot safe

A kernel update changes the lowest software layer of the operating system. The package installation is normally routine, but the reboot is a maintenance event. Plan it when an interruption is acceptable, especially on a server or a machine running a game server, storage workload, or other long-lived process.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Pre-update checklist

  • Record the current value from uname -r so you know which kernel is known-good.
  • Make sure you have console or out-of-band access if the machine is remote. A network-only connection is not enough if the new kernel prevents networking from starting.
  • Confirm that important work is saved and that services can be stopped and started cleanly.
  • Keep the previous known-good kernel installed. It is the immediate recovery option if the new boot has a driver, firmware, or module problem.
  • Choose a maintenance window long enough to reboot and test the machine, rather than treating the restart as an unplanned interruption.

Do not delete the fallback kernel before the new one has booted and passed your checks. Kernel cleanup is sensitive to the Ubuntu release and the package state, so removal should be a separate, deliberate task.

Step-by-step: update and boot the new kernel

1. Check the running kernel

uname -r

Save the output in your maintenance notes. This tells you what is currently active, which is important when several kernel packages are present.

2. Refresh package metadata

sudo apt update

Read any errors before continuing. If APT cannot refresh its indexes, the machine has not yet established a reliable view of available updates; fix that package-manager problem first instead of guessing which kernel package to install.

3. Install the available upgrades

sudo apt upgrade

Ubuntu’s normal kernel metapackage should pull in the current kernel for the selected stream. Let the command finish and note whether a new kernel package was installed. A package update alone does not change the kernel already running in memory.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
UNIX and Linux System Administration Handbook, 4th Edition
  • New
  • Mint Condition
  • Dispatch same day for order received before 12 noon
  • Guaranteed packaging
  • No quibbles returns

If APT says packages are kept back because dependency changes are needed, follow the full-upgrade procedure documented for that Ubuntu release. Do not work around the message by deleting the metapackage or manually removing related kernel packages.

4. Reboot if a new kernel was installed

sudo reboot

Schedule this restart rather than assuming the package installation has already taken effect. The bootloader selects the new kernel during startup; until then, uname -r will continue to report the old one.

5. Verify after startup

uname -r

Compare the result with the package update output and your maintenance record. A changed version indicates that the machine is running the new kernel. If the version did not change, investigate which kernel was selected at boot before removing anything.

Generic GA and HWE kernels: what the choice means

Ubuntu LTS releases offer two broad kernel tracks. The generic GA (General Availability) kernel is the stable default intended for broad hardware and workloads. HWE (Hardware Enablement) provides newer upstream kernel versions during the LTS lifecycle, primarily to improve support for newer hardware.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Aspect Generic GA HWE
Primary purpose Broadly supported, stable kernel for general workloads Newer kernel stream for newer hardware support
Change rate Conservative release stream Rolling stream that is replaced by a newer HWE stack as the LTS lifecycle progresses
Typical fit Systems without a specialized need for the newest kernel LTS systems whose hardware benefits from newer kernel support
Desktop default Depends on the Ubuntu release Canonical documents Ubuntu 22.04 and 24.04 Desktop as tracking HWE by default
Server default Commonly the default on Ubuntu Server Available as an option when newer hardware support is needed
Out-of-tree and DKMS modules Usually offers the least change for modules tied to a known kernel line Requires checking that proprietary or out-of-tree modules support each newer HWE kernel

Canonical’s general recommendation is the latest LTS “-generic” kernel for customers and partners who do not have specialized bleeding-edge workloads or the latest hardware needs. HWE is not automatically “better”; it trades a newer hardware baseline for a faster-moving kernel stream that may require more compatibility testing.

When GA is the safer choice

Choose or remain on the generic GA stream when the machine is stable, its hardware is already supported, and minimizing kernel change is more important than gaining newer device support. This is often appropriate for long-lived server installations and systems with sensitive DKMS or proprietary driver stacks, provided the release’s supported configuration uses that stream.

When HWE is justified

HWE is useful when an LTS installation is running hardware introduced after the original LTS kernel baseline, or when a device needs a newer kernel driver supplied through the HWE stack. Treat each HWE transition as a compatibility event: test graphics, storage, networking, and any DKMS modules after boot.

Installing the matching HWE metapackage

Install the HWE metapackage that matches the Ubuntu release already installed on the machine. For example, Canonical documents these forms:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo apt-get install --install-recommends linux-generic-hwe-24.04

On Ubuntu 22.04, use:

sudo apt-get install --install-recommends linux-generic-hwe-22.04

Do not copy a release number from another machine. The metapackage must match the installed release, and desktop and server defaults can differ. After installation, use the same update-and-reboot process: allow the package transaction to finish, reboot during a maintenance window, and verify the running version with uname -r.

Keep the prior kernel until the HWE kernel has passed your checks. If an application depends on an external module, confirm that the module rebuilds and loads for the new kernel before considering the migration complete.

What Livepatch changes—and what it does not

Canonical Livepatch is an Ubuntu Pro service that applies supported high- and critical-severity Linux kernel security fixes to the running kernel. For a covered vulnerability, it can reduce the need for an immediate reboot and let an administrator schedule downtime more flexibly.

Enable Livepatch

sudo pro attach
sudo pro enable livepatch
pro status
canonical-livepatch status

pro attach connects the installation to an Ubuntu Pro entitlement. pro enable livepatch enables the service, while the status commands show whether the service is enabled and whether the current kernel has an applicable patch state.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Changes Livepatch can cover

  • Supported high-severity kernel vulnerabilities.
  • Supported critical-severity kernel vulnerabilities.
  • Security fixes for which Canonical can produce a live patch for the running kernel and its supported configuration.

Changes that still require an ordinary kernel update and reboot

  • Non-security bug fixes.
  • Performance improvements.
  • Driver updates and new hardware support.
  • New kernel features.
  • Security patches that cannot be produced as live patches.
  • Lower-severity vulnerabilities that are outside the Livepatch service’s coverage.

Livepatch support is kernel-specific. Check Canonical’s current support matrix before relying on it for a particular Ubuntu release, architecture, flavour, or HWE version. A status report showing that Livepatch is enabled is not a promise that every future kernel change will be applied live.

Question Ordinary package update Livepatch
How it is delivered Ubuntu’s package manager: APT on Desktop or Server; snapd on Ubuntu Core Ubuntu Pro Livepatch service
Main coverage Kernel packages, including fixes and changes not suitable for live patching Supported high- and critical-severity kernel security fixes
Reboot Required to start the installed kernel Not immediately required for a covered live-patched vulnerability
Handles feature, driver, and performance changes Yes, through the normal kernel package No
Replaces routine updates This is the routine update mechanism No; Canonical says normal update tools must still be used for all standard kernel updates
Entitlement Uses the Ubuntu release’s package repositories Requires an Ubuntu Pro attachment and a supported kernel

The practical model is complementary: enable Livepatch to reduce urgent reboot pressure for covered security fixes, but continue normal updates and plan periodic reboots so the machine receives every kernel change outside that narrow scope.

Verify more than the version number

uname -r is the first post-reboot check, not the whole acceptance test. A kernel can start successfully while a device, module, or service has failed to initialize. Test the functions that matter for that machine.

  • Storage: confirm that required disks, filesystems, and mount points are available.
  • Networking: verify the expected interfaces, routes, name resolution, and remote access.
  • Graphics: on a desktop, confirm that the display session and acceleration work as expected.
  • DKMS and external modules: check that required modules rebuilt for and loaded on the new kernel.
  • Critical services: verify application, database, virtualization, game-server, or other workload-specific services.

Record the tested kernel version with the result of these checks. This makes it clear which kernel was validated and preserves an evidence trail for a later rollback decision.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

If the new kernel does not boot or a device fails

The machine does not reach a usable system

At the GRUB menu, open Advanced options and select the previous known-good kernel. Booting the fallback establishes whether the failure is specific to the new kernel rather than to the package manager or hardware generally.

The system boots but a module or device is missing

Keep the older kernel available and investigate package, DKMS, firmware, and driver logs while running the fallback or the new kernel as appropriate. A newer HWE kernel may expose an incompatibility in an out-of-tree module even when the base Ubuntu system is healthy.

Remote access disappears after reboot

Use local console or out-of-band access to select the fallback kernel. Check networking and the relevant driver or firmware path before attempting another reboot. Do not remove the kernel that still provides access.

The new version is installed but the old version is still running

Run uname -r and inspect the boot selection. The package installation can succeed without changing the running kernel until a reboot occurs, and a bootloader selection can keep an older entry active. Resolve the selection issue before cleaning packages.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Kernel cleanup: remove only obsolete entries

Ubuntu may retain multiple kernels so a known-good fallback remains available. Cleanup should happen only after the new kernel has booted, been tested, and become the version you intend to keep. Never remove the kernel reported by uname -r, and retain at least one tested fallback.

Because cleanup rules depend on the release, metapackage, and installed package state, use the package-management procedure documented for that Ubuntu version. Avoid manual deletion from the boot files or removing the standard kernel metapackage to freeze a version; either action can leave the installation without the normal path for future updates.

A practical maintenance policy

For a desktop

Run routine package updates, reboot when a kernel package is installed, and test graphics, audio, networking, storage, and any DKMS-dependent hardware. If the release tracks HWE by default, treat its rolling kernel changes as part of the supported desktop lifecycle rather than trying to pin an old kernel by removing the metapackage.

For a server

Use a maintenance window, confirm console access, record the current kernel, update packages, reboot, and perform service-level checks. Servers that do not need newer hardware support commonly remain on the GA default, while HWE can be selected when the hardware requires its newer kernel support.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For systems using Livepatch

Monitor pro status and canonical-livepatch status, but continue scheduling ordinary kernel maintenance. Livepatch narrows the emergency-reboot requirement for supported high and critical vulnerabilities; it does not provide feature, driver, performance, or universal security coverage.

Operational checklist

  1. Run uname -r and record the known-good kernel.
  2. Confirm console or out-of-band recovery access and a suitable maintenance window.
  3. Run sudo apt update.
  4. Run sudo apt upgrade; use the release’s documented full-upgrade procedure only if dependencies require it.
  5. Keep the previous kernel installed.
  6. Reboot if a new kernel package was installed.
  7. Run uname -r after startup.
  8. Test storage, networking, graphics, DKMS modules, and critical services.
  9. If the new kernel fails, select the older entry under GRUB’s Advanced options.
  10. Clean obsolete kernels only after verification, never deleting the running kernel or the fallback.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.