Overview

Running Kernel Awareness enables Vulnerability Management (VM) to identify and use the active kernel version running on a host during vulnerability evaluation. This improves the accuracy of kernel vulnerability assessment by focusing on vulnerabilities that affect the kernel actually in use, rather than every kernel package detected on the host.

This feature is available as part of the U14 release.

What is changing

Aqua is introducing Running Kernel Awareness, which adds runtime kernel context to vulnerability evaluation.

A host or virtual machine often contains multiple kernel package versions due to:

  • Build-time dependencies
  • Historical package layers
  • Base image inheritance
  • Kernel upgrades that leave older kernel packages installed

For example, a host may contain kernel packages 5.4, 5.10, and 5.15, while the host is actually running only:

Running kernel: 5.15

Kernel vulnerabilities affecting versions 5.4 or 5.10 are therefore not relevant to the host. By incorporating runtime kernel information, VM can accurately determine which kernel vulnerabilities are applicable and prioritize only those that affect the active kernel.

As part of this feature:

  • Runtime collects and exposes the active host kernel version.
  • Vulnerability Management consumes this information during vulnerability evaluation.
  • Kernel-related findings are evaluated against the running kernel, reducing false positives and improving prioritization.

Running kernel information is added to the vulnerability dataset and surfaced in the UI and API to support more accurate kernel vulnerability analysis.

Why this change is being made

Today, Vulnerability Management evaluates all detected kernel packages because it has no visibility into which kernel version is actively running. This can result in kernel vulnerabilities being reported even though they are not exploitable by the running workload.

Running Kernel Awareness provides runtime context by exposing the active host kernel version, enabling:

  • More accurate vulnerability assessment
  • Better prioritization of kernel-related findings
  • Reduced false positives from non-running kernel packages

Customer impact

This is a new feature and does not affect existing customer workflows.

Customers will see running kernel information integrated into vulnerability data and available through the UI and API. Existing processes continue to work; the enhancement improves the quality of kernel vulnerability analysis.

Prerequisites

All scanner instances must be upgraded to a version that supports this feature before relying on Running Kernel Awareness.

Because scan requests are distributed across available scanners, environments running a mix of upgraded and older scanner versions may experience inconsistent running kernel information. Older scanners do not collect or report the required runtime kernel attributes.

Important notes:

  • Once a host has been scanned by an upgraded scanner, the running kernel information is stored in the database and will remain available.
  • Until all hosts have been scanned at least once by an upgraded scanner, customers may observe incomplete or inconsistent running kernel information across their environment.
  • To ensure accurate and consistent kernel vulnerability assessment, upgrade all scanner instances before relying on this feature.

Frequently Asked Questions

Q: Will this change affect my existing vulnerability workflows?

A: No. This is a new capability that enriches vulnerability data. Existing workflows are not disrupted.

Q: Why am I still seeing kernel vulnerabilities for packages that are not running?

A: Ensure all scanner instances are upgraded and that affected hosts have been rescanned by an upgraded scanner. Until runtime kernel data is collected and stored, VM may continue to evaluate all detected kernel packages.

Q: When does running kernel information become available for a host?

A: After the host is scanned by a scanner version that supports this feature. The information is then stored in the database and remains available for subsequent evaluation.

Q: Do I need to upgrade only some scanners?

A: We strongly recommend upgrading all scanner instances. Mixed scanner versions can produce inconsistent running kernel data because scan requests are distributed across the scanner pool.

Q: Where can I see running kernel information?

A: Running kernel information is surfaced in the Aqua platform UI and API as part of the vulnerability dataset for improved kernel vulnerability analysis.