Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my RHEL 5&6 servers set to keep 1 old kernel after updates, I do this in case I need to recover the system for any number of reasons. My question is related to security of the system when running with the most current kernel but still having a copy of the old kernel installed. When I scan them with Retina I always get hits for the old kernel, but the system is running with the most current. I guess Retina is just checking for presence of the kernel on the system and not determining whether it is the current running kernel. My question is does the mere presence of the old kernel on the system constitute a security issue? Any thoughts?

share|improve this question
up vote 6 down vote accepted

No, it does not. If it's not running, it's merely a file in the file system. If an attacker manages to restart your system with this kernel, he has already full control over the system anyway.

share|improve this answer
Thanks, I have always justified keeping one old kernel but recently had an inspector tell me to prove that I can safely keep a kernel. I asked the question with Red Hat but got a non-helpful answer. – user1548815 Apr 14 '14 at 18:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.