Vulnerability reports show not running kernel packages?

[cfi]

@cfi

if you want to accept the risk of having vulnerable but not running kernel versions installed you can work with Overrides and False Positives .

An alternative way to accept the risk of having vulnerable but not running kernel versions on the system is now available:

Setting: Report vulnerabilities of inactive Linux kernel(s) separately