Check KernelCare in three stages: identify the kernel actually running, confirm the vendor’s coverage for that exact build, then inspect any applied live patches. These are different questions. A supported distribution, an installed agent and a successful licence activation do not by themselves prove that a particular vulnerability is fixed.
1. Identify the running environment
These checks are for the authorised server administrator. If you only manage a hosting account, ask the provider to perform them. Record the distribution and release from the system’s operating-system information, and whether this is a host, virtual machine or container.
uname -rdisplays the running kernel release.uname -mdisplays the machine architecture.
Use the full result, including suffixes. A kernel package installed on disk may differ from the kernel currently running. A container may report its host’s kernel; that does not give the container administrator authority to patch the host.
2. Confirm current vendor coverage
Find the distribution, architecture and kernel branch in the maintained-kernel listing, then match the exact running release in the patch catalogue. Check whether the branch is actively maintained and whether the relevant patch is available. If there is no exact match, request confirmation rather than substituting a similar version.
TuxCare also documents a compatibility checker. If the administrator uses it, obtain and review it through the current official documentation. A compatibility result is not a record of patches applied to the server.
3. Inspect the installed agent’s reports
If KernelCare is installed, the following documented information commands inspect its state without requesting patch application:
kcarectl --versiondisplays the KernelCare agent version, not the kernel version or the list of applied patches.kcarectl --infoshows information about installed patches.kcarectl --patch-infolists applied patches.kcarectl --unamereports KernelCare’s effective kernel version.
Keep any error text with the results. An effective version is not a newly booted kernel and does not include every possible feature or non-security fix. Conversely, an unchanged version string alone does not establish patch failure. For a specific CVE, compare the applicable vendor advisory with the installed kernel and applied-patch evidence; ask for clarification if they do not agree.
Resolve uncertainty before changing anything
If the agent is absent, a command fails or the kernel is unrecognised, record that outcome. Do not turn an incomplete check into a “fully protected” conclusion or apply changes merely to obtain a green result.
Send Nuagerie a focused support request with the service concerned, check time, distribution, exact kernel, architecture and relevant output. Remove licence keys and unrelated identifiers. This gives the responsible administrator useful evidence for the next diagnostic or maintenance step.
