diff --git a/articles/vulnerability-processing.md b/articles/vulnerability-processing.md
index c534385259..b2ef6f1cdc 100644
--- a/articles/vulnerability-processing.md
+++ b/articles/vulnerability-processing.md
@@ -1,6 +1,6 @@
 # Vulnerability processing
 
-Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts. 
+Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts.
 
 To see what software is covered, check out the [Coverage section](#coverage).
 
@@ -23,9 +23,13 @@ Fleet detects vulnerabilities for these software types:
 
 Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis.
 
-For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
+If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet.
 
-If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet. 
+### Linux kernels
+
+For Ubuntu, Debian, and Amazon Linux, kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
+
+Linux kernel vulnerabilities are surfaced as OS-level vulnerabilities in the **Software > OS** page. Fleet shows the total number of vulnerability occurences across all hosts.
 
 ## Sources