Distinguishes the currently-booted kernel from a newer installed-but-not-yet- booted one, for kernel CVE relevance.