Occasionally, and often due to a security issue, a change is accepted into a kernel package that changes its ABI. The ABI change is represented by a change in the ABI version portion of the linux-image package name (similar to soversion for a shared library). For example, in linux-image-2.6.18-1-686, the ABI version is 1. Any out-of-tree modules need to be recompiled against the updated linux-headers.
Since a change in the ABI version changes the package name, apt will not automatically upgrade a system to the new kernel. In order for users to track the latest available kernel (meaning the latest kernel security fixes in the stable distribution), installing one of the kernel meta packages (linux-image-flavour) is strongly recommended.
For example, for the original Debian 4.0 (Etch) release, linux-image-2.6-686 depended upon linux-image-2.6.18-4-686. With the first point release (4.0r1), an updated kernel with an ABI change was introduced, resulting in a new linux-image-2.6.18-5-686 package. At the same time, an updated version of linux-image-2.6-686 was made available with a dependency on linux-image-2.6.18-5-686. Through this dependency dist-upgrading linux-image-2.6-686 resulted in the new linux-image-2.6.18-5-686 package being pulled in automatically for users.
External modules (i.e. modules packaged in separate packages) obviously need to be upgraded at the same time. Where the module package supports DKMS, this will happen automatically if the appropriate linux-headers metapackage (linux-headers-flavour) is also installed. Where the module package supports ModuleAssistant, it is necessary to request a rebuild automatically.