A new kernel installed but not running

apt upgrade installed a new kernel and uname -r still shows the old one. The kernel is only loaded at boot.

Which means: kernel vulnerabilities remain, driver fixes do nothing, and /lib/modules no longer matches the running kernel, so some modules fail to load.

uname -r
ls /boot/vmlinuz-*
needrestart

needrestart also lists services still using old libraries — nginx after an OpenSSL upgrade is the classic case, still holding the previous .so.

Do not auto-reboot production, but do not postpone forever either. Pick a window, disable automatic reboots in unattended-upgrades, and do it deliberately.