[KRNL-5830] Always false-positive on Raspberry Pi OS: two kernel flavours per version means "newest on disk" is never the running kernel

Lynis 3.1.7 (upstream tarball, run as root) OS: Raspberry Pi OS Lite / Debian 13 (trixie), arm64 Hardware: Raspberry Pi 5

Symptom

KRNL-5830 always warns "Reboot of system is most likely needed", including immediately after a fresh reboot on a fully up-to-date system.

Cause, from Lynis's own log

Result: file /var/run/reboot-required.pkgs not found
Result: file /var/run/needs_restarting not found
Result: /boot exists, performing more tests from here
Result: found /boot/vmlinuz-6.18.34+rpt-rpi-v8
Result: version derived from file name is '6.18.34+rpt-rpi-v8'
Result: found version 6.18.34+rpt-rpi-v8

Running kernel:

$ uname -r
6.18.34+rpt-rpi-2712

Why it can never pass on this platform

Raspberry Pi OS installs TWO kernel flavours side by side, always at the same version: -2712 (Raspberry Pi 5) and -v8 (older Pi models).

$ ls /boot/vmlinuz-*
/boot/vmlinuz-6.18.33+rpt-rpi-2712
/boot/vmlinuz-6.18.33+rpt-rpi-v8
/boot/vmlinuz-6.18.34+rpt-rpi-2712
/boot/vmlinuz-6.18.34+rpt-rpi-v8

include/tests_kernel selects the on-disk kernel with:

FOUND_VMLINUZ=$(ls -v ${ROOTDIR}boot/vm[l0-9]* | grep -v '\-rescue-' | tail -1)

ls -v ... | tail -1 sorts ...-v8 after ...-2712, so the selected file is always the -v8 flavour, while the running kernel on a Pi 5 is always -2712. The comparison therefore never matches and the warning is emitted on every scan regardless of system state.

Suggested direction

Prefer the on-disk kernel whose flavour suffix matches uname -r, or compare only the version portion preceding the flavour suffix.

Related but a different distro family: #1407 (multiple kernels installed, Artix).