The Risky Upgrade
Ubuntu is generally configured to keep your system secure by automatically downloading and installing security patches in the background using a tool called unattended-upgrades. Usually, this process is seamless. However, occasionally, these automatic updates include a new Linux kernel. If you are running specialized hardware with proprietary drivers (like specific Nvidia GPUs or complex Wi-Fi cards), an automatic kernel update can break compatibility, resulting in a black screen or a loss of internet access the next time you reboot. In production environments or on sensitive hardware, updating the kernel must be a tightly controlled, manual process.
Placing a Hold on the Kernel
To maintain system stability and stop Ubuntu from automatically updating the kernel while still allowing other security patches to install, you must place a strict “hold” on the kernel packages using the APT package manager.
Open a terminal window (Ctrl+Alt+T). First, you need to identify the exact names of the kernel packages installed. Run the command: dpkg -l | grep linux-image. You will see packages like `linux-image-generic`. To prevent APT (and thus unattended-upgrades) from ever touching these, you use the apt-mark command. In your terminal, type: sudo apt-mark hold linux-image-generic linux-headers-generic and press Enter (you may need to add specific version names depending on your setup). The terminal will confirm that the packages are placed on hold. Ubuntu will now continue to automatically update Firefox and system libraries, but the core kernel will remain frozen until you manually unhold it.