debvulns 0.2.4 adds needrestart integration and running-kernel CVE checks for Debian

Debian developer Vasudev Kamath has released debvulns 0.2.4, adding two significant capabilities to the vulnerability tracking tool: integration with the needrestart utility to identify services still running outdated binaries in memory, and proper handling of kernel vulnerabilities by checking the active running kernel version rather than just the installed package version. The needrestart integration addresses a common gap in security posture where package updates are installed but processes continue executing vulnerable code until restarted, with debvulns now surfacing this state through Prometheus metrics and Grafana-compatible tags for monitoring and alerting pipelines.

The kernel vulnerability handling closes a false-security scenario where CVEs were previously marked resolved once the patched deb package was on disk, even when the system had not yet rebooted into the fixed kernel. Version 0.2.4 now compares the running kernel release against the fixed version and continues reporting the system as vulnerable until a reboot occurs. These changes consolidate vulnerability and remediation signals into a single observable interface without replacing existing tools like needrestart or debsecan.

What changes in debvulns 0.2.4

• needrestart integration: debvulns now consumes needrestart output to identify services executing stale binaries in memory after security updates, distinguishing between packages installed on disk and processes actually using patched code.
• Prometheus metrics export: Vulnerability and restart states are aggregated into standardized Prometheus metrics and tags, enabling visualization in Grafana and consumption by alerting systems or downstream automation.
• Running-kernel validation: Kernel CVEs are now resolved only when the active running kernel release matches or exceeds the fixed version, not merely when the patched package is installed.
• Reboot-required state tracking: The tool explicitly exports whether a system reboot is needed to complete kernel vulnerability remediation, surfacing this through the same metrics pipeline as service restart states.
• Batch-mode awareness: The needrestart integration respects needrestart's batch mode behavior, which avoids restarting sensitive components like dbus to prevent session destabilization on headless systems.

Why it matters

For Debian system administrators and security teams operating at scale, debvulns 0.2.4 closes a critical observability gap between package management and actual security posture, enabling automated verification that updates have taken effect rather than merely been installed. The Prometheus-native output aligns with existing infrastructure monitoring stacks, making it practical to integrate Debian vulnerability state into fleet-wide alerting without custom glue code. This is particularly relevant for server deployments where unattended upgrades may install kernel patches but operators delay reboots, leaving systems exposed while vulnerability scanners incorrectly report compliance.