I'm trying to understand Debian kernel image package versioning.

Take this output for example:

$ apt search linux-image | grep amd64-unsigned

linux-image-5.10.0-10-amd64-unsigned/stable 5.10.84-1 amd64
linux-image-5.10.0-11-amd64-unsigned/stable-security 5.10.92-1 amd64
. . .

If I understand it correctly, we have:

  • Kernel version 5.10.84-1 → ABI version 5.10.0-10
  • Kernel version 5.10.92-1 → ABI version 5.10.0-11

Clearly, Linux kernel doesn't seem to follow the semver model as the ABI is changing rather arbitrarily between patch releases.

So how does Debian determine when the ABI version number needs to be bumped?

1 Answer 1


This is documented in the Debian kernel handbook (Debian users can also install the debian-kernel-handbook package):

Maintaining and updating the ABI

In order to avoid the need for users to rebuild out-of-tree modules frequently, we try to avoid changing the kernel ABI during updates to a Debian stable or oldstable release. Most importantly, we avoid making such changes without changing the ABI name, except where it appears that out-of-tree modules do not depend on that part of the ABI.

Bug fixes or configuration changes to the kernel may alter the ABI. If an exported function is conditional on CONFIG_FOO, or it uses a type whose definition depends on CONFIG_FOO, then turning CONFIG_FOO on or off changes the ABI of that function, and thus of the kernel as a whole. Enabling or changing the configuration of a single driver usually doesn't change the ABI, because most drivers don't export anything.

The kernel build process generates a 'symbol version' for each exported function or variable. This is a hash of the definitions that it depends on, and should change whenever the function's ABI changes. The kernel module loader detects incompatible modules by comparing symbol versions. The whole set of symbol versions represents the kernel ABI.

We collect the symbol versions for previously uploaded packages under the directory debian/abi and then compare the new kernel with those. If the ABI name is unchanged but the ABI itself is changed - except for additions, or changes that we have marked as acceptable - then the build is aborted.

So essentially, the ABI is changed if compatibility with existing modules can’t be guaranteed. ABI bumps are traced in the package changelog, albeit not necessarily with the specific reason for the bump (there may well be more than one).

See Debian Linux kernel versioning for a more general description of the Debian kernel versioning scheme.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .