Occasionally, and often due to a security issue, a change is accepted into a kernel package that changes its ABI. The ABI change is represented by a change in the SONAME portion of the kernel-image package name. For example, in linux-image-2.6.18-1-686, the SONAME is 1. Any kernel-module packages need to be recompiled against the updated kernel-headers.

Since a change in the SONAME changes the package name, apt will not automatically upgrade a system to the new kernel. In order for users to track the latest available kernel (meaning the latest kernel security fixes in the stable distribution), installing one of the kernel meta packages is strongly recommended.

For example, for the original Debian 4.0 (Etch) release, linux-image-2.6-686 depended upon linux-image-2.6.18-4-686. With the first point release (4.0r1), an updated kernel with an ABI change was introduced, resulting in a new linux-image-2.6.18-5-686 package. At the same time, an updated version of linux-image-2.6-686 was made available with a dependency on linux-image-2.6.18-5-686. Through this dependency dist-upgrading linux-image-2.6-686 resulted in the new linux-image-2.6.18-5-686 package being pulled in automatically for users.

External modules (i.e. modules packaged in separate packages) obviously need to be upgraded at the same time. To ensure this, the user has to install the corresponding meta package <module>-modules-2.6-<variant>. This meta package should depend on the virtual package "linux-latest-modules-<version-with-abi>" to ensure that it's upgraded together with the main kernel meta-package (which provides the corresponding linux-latest-modules-<version-with-abi>).

For example:

Package: kqemu-modules-2.6-686
Depends: kqemu-modules-2.6.18-5-686, linux-latest-modules-2.6.18-5-686

Package: linux-image-2.6-686
Depends: linux-image-2.6.18-5-686
Provides: linux-latest-modules-2.6.18-5-686

This way, when linux-image-2.6-686 is upgraded to 2.6.18-6-686, it stops providing the old linux-latest-modules-2.6.18-5-686. This breaks the old kqemu-modules-2.6-686 which thus has to be updated together with the main metapackage. See http://bugs.debian.org/428783 for the original discussion of this dependency scheme.