Managing installed kernels on Debian and Ubuntu: cleanup, /boot space, HWE and Livepatch

What it is

Every kernel security update on Debian or Ubuntu installs a new linux-image-* package alongside the running one rather than replacing it, so the system can still boot the old kernel if the new one fails. apt list --installed | grep linux-image shows how many are present; dpkg -l 'linux-image-*' gives version detail. Space and boot-menu clutter accumulate in /boot until the old ones are removed.

Why it matters

/boot is often a small separate partition, and it can fill up entirely after several kernel updates, which then blocks any further kernel install — including a security fix — until space is freed. On Ubuntu, the choice between the GA and HWE kernel and whether Livepatch is enabled also changes how disruptive a kernel security fix is to apply.

How to apply

• Run apt-get autoremove regularly, or let unattended-upgrades do it (Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";). apt-get's manual page describes autoremove as removing "packages that were automatically installed to satisfy dependencies for other packages and are now no longer needed" — kernel packages are handled specially: /etc/apt/apt.conf.d/01autoremove-kernels protects the running kernel and the most recent ones, and older kernels become removable.
• Never remove the currently running kernel; check uname -r first and confirm autoremove is not targeting it (it will not remove the running kernel's package by default, but a manual apt-get remove of the wrong package name can).
• To keep a specific kernel version installed deliberately (e.g. during a driver validation), hold it: apt-mark hold linux-image-<version>, using the same hold mechanism apt-mark documents for any package.
• Ubuntu-specific: LTS releases get a Hardware Enablement (HWE) kernel stack, described by Canonical as providing "newer kernel and X11 display support for existing Ubuntu LTS releases"; Server installs default to the GA kernel with HWE as an opt-in metapackage (linux-generic-hwe-<release>). Debian has no equivalent rolling-kernel mechanism.
• Ubuntu-specific: Canonical's Livepatch service applies selected kernel security patches in memory, avoiding the reboot a traditional kernel update needs; Canonical positions it as an alternative for workloads where "the updated system needs to be rebooted, potentially disrupting" services, applying patches "between scheduled maintenance windows" instead. Livepatch is part of Ubuntu Pro (enabled with pro enable livepatch, free for a small number of personal machines) and still requires periodic reboots for patches it cannot apply live.

Pitfalls

• Running low on /boot space silently blocks the next kernel security update; monitor free space there, not just on /.
• Holding a kernel version also blocks its security updates — track holds explicitly and review them regularly, the same caution as for any other apt-mark hold.
• Enabling HWE mid-support-cycle changes which kernel branch future updates come from; check apt-cache policy linux-image-generic-hwe-<release> before switching a production host.