diff --git a/docs/Contributing/Vulnerability-processing.md b/docs/Contributing/Vulnerability-processing.md
index 5c111316fa..6f7db26328 100644
--- a/docs/Contributing/Vulnerability-processing.md
+++ b/docs/Contributing/Vulnerability-processing.md
@@ -11,7 +11,7 @@ For Fleet Premium users, each CVE includes its Common Vulnerability Scoring Syst
 Fleet's strategy for detecting vulnerabilities (CVEs) varies according to the host's platform and
 the software in question.
 
-### Windows/MacOS hosts using the NVD dataset
+### macOS, Windows, and Linux hosts using NVD
 
 First, Fleet retrieves the installed software for each host using osquery queries. Then, Fleet
 translates each installed software into [Common Platform Enumeration (CPE)](https://en.wikipedia.org/wiki/Common_Platform_Enumeration) names.
@@ -91,6 +91,19 @@ refreshed on a daily basis.
 Finally, we look at the software inventory of each host and execute the assertions contained in the
 corresponding OVAL file - any match is reported using the same channels as with Windows/Mac OS vulnerabilities
 
+#### Ubuntu kernel vulnerabilities
+
+For Ubuntu Linux, kernel vulnerabilities are detected against any installed kernel, even if it is not the actively running kernel.  
+
+Vulnerabilities are matched against software matching `linux-image.*` 
+(ie.`linux-image-5.4.0-163-generic`).
+
+The Canonical OVAL feed is opinionated on the linux
+variant (ie. `-generic`) when matching against vulnerabilities, so when Fleet detects a kernel variant not
+available in the OVAL feed, it uses the NVD feed to look for vulnerabilities matching the following
+CPE pattern:
+`cpe:2.3:o:linux:linux_kernel:*;*:*:*:*:*:*:*:*`
+
 ## Performance
 
 ### Windows/Mac OS
diff --git a/docs/Using Fleet/Vulnerability-Processing.md b/docs/Using Fleet/Vulnerability-Processing.md
index 2217919782..2e675e5735 100644
--- a/docs/Using Fleet/Vulnerability-Processing.md	
+++ b/docs/Using Fleet/Vulnerability-Processing.md	
@@ -25,6 +25,8 @@ Fleet detects vulnerabilities for these software types:
 
 As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches.
 
+For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
+
 ### Advanced configuration
 
 Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful