The VyOS kernel release string is just the upstream version plus the flavor, e.g. 6.18.60-vyos. If we rebuild the same upstream kernel with extra patches, such as an urgent security fix that isn't in a stable release yet, the new build gets exactly the same version as the old one. The package name, uname -r, /lib/modules/ and show version kernel look the same either way. So you can't tell from a running system or an image whether it has the patched kernel. Package dependencies also can't tell the two builds apart.

What changes

A VyOS internal revision number goes between the upstream version and the flavor:
6.18.60-vyos becomes 6.18.60-1-vyos

• There's a new kernel_revision setting in data/defaults.toml, next to kernel_version, starting at 1.
• Bump it whenever the same upstream version is rebuilt with extra patches (-2-vyos, -3-vyos ...). Reset it to 1 when kernel_version moves to a new upstream release.
• The revision is part of the kernel's own release string, so it shows up in uname -r, the module directory, the linux-image-* package name and the Debian package version
• The ISO build installs linux-image-<version>-<revision>-<flavor>. The flavor is still vyos, so live-build finds the kernel and boot files for GRUB and syslinux as before.