Kali Linux 2026.3 Released: Kernel 7.1.5, New Pentest Tools and Container Image Builds

What shipped​

The release carries 126 package updates and moves the kernel from 6.19 to 7.1.5. That jump has some history. In the 2026.2 announcement in June, the Kali team said it stayed on 6.19 on purpose. Kernel 7.0 had caused reported incompatibilities with NVIDIA DKMS drivers when it reached Debian. Kali kept 7.0 in kali-experimental for people who wanted it early. The 2026.3 notes list the kernel bump but don't repeat that caveat. If you run NVIDIA hardware on bare metal, test the upgrade before you trust it on a production workstation.

The six new tools​

Kali says the new tools are in its network repositories. The announcement doesn't say they are installed by default.

For Windows-centric environments, snaffler-ng is the one to notice. SMB file shares are where credentials and sensitive documents tend to pile up. A tool that hunts for them is useful to a pentester and equally useful as a model of what an attacker will look for. Defenders can run the same kind of exercise against shares they own. As always, run these only against systems you own or have written permission to test.

Build-scripts refresh​

This is the headline change. Kali's public build scripts generate every official image offered on its download page. The refreshed scripts now share a more consistent structure, layout, command-line options, features and output across supported platforms.

The practical addition is a script called build-in-container.sh. It detects whether Docker or Podman is present, creates a build container, and runs the image build inside it. Kali had previously recommended building Kali on Kali, which created a chicken-and-egg problem. The project has also improved its documentation for building on Debian-based systems.

Kali's own example uses the kali-installer repository:

1. Install git and ca-certificates, clone the kali-installer repository from Kali's GitLab, and change into the directory.
2. To build directly on your machine, install the dependencies (simple-cdd, debian-cd, cpio, mtools, dosfstools and xorriso) and run sudo ./build.sh.
3. The defaults build a Kali rolling installer image for AMD64. The sample output names the file kali-linux-rolling-installer-amd64.iso.
4. To keep dependencies off your machine, install Podman and run sudo ./build-in-container.sh instead.
5. Options include hostname, extra packages, branch, variant and architecture. For example, --hostname haxbox --packages rustscan, or --branch kali-dev --variant netinst --arch arm64. Run ./build.sh --help for the full list.

The caveats​

The refresh is unfinished. Kali says it hoped to refresh every script for this release but missed. It is aiming for Kali 2026.4. Teams with CI jobs based on the older scripts should review their pipelines, because changes made during the refresh may have broken older workflows. The Kali team itself apologized for breaking CI pipelines along the way. If you maintain automated image builds, pin your current script versions and test the new ones in a lab before you switch.

Next, the team plans to automate builds and workflows. After that it will demonstrate different setups and customization options. Its own shorthand for the plan is "crawl, walk, run."

Desktop updates​

The optional KDE desktop moves to Plasma 6.7. The standout feature is per-screen virtual desktops. On a multi-monitor setup you can keep terminals on one display and a browser, Burp or documentation on another, without changing every screen's workspace at once. Kali also lists:

• Quicker desktop switching from Overview.
• Continued improvement of Wayland protocols and portals.
• Performance and power-use optimizations, especially on integrated Intel GPUs and with multiple full-screen windows.
• Duplicable network connections.
• Refinements to System Monitor.

These are Kali's descriptions, not benchmark results. Kali also added icons to tools that had none and updated others to make them easier to recognize in the applications menu.

How to update​

Kali gives these steps for existing installs:

1. Make sure your APT source points at kali-rolling with the components main contrib non-free non-free-firmware.
2. Run sudo apt update && sudo apt -y full-upgrade.
3. Run cp -vrbi /etc/skel/. ~/ to copy default skeleton files.
4. If /var/run/reboot-required exists, reboot.
5. Verify with grep VERSION /etc/os-release. You should see VERSION_ID="2026.3" and VERSION_CODENAME=kali-rolling.

On the source file, there is a discrepancy. BleepingComputer's version of the instructions writes a one-line entry to /etc/apt/sources.list. Kali's own post uses the newer /etc/apt/sources.list.d/kali.sources file. Kali announced in 2026.2 that the old sources.list is retired in favor of the new file. Fresh installs use the new format, existing systems aren't changed, and both formats work. Kali warned that APT will eventually flag the old file and suggest modernizing it. Follow Kali's current format, because blindly overwriting sources.list on a system already using kali.sources could leave you with duplicate entries.

Kali's sample uname -r output is 7.1.5+kali-amd64. Kali notes the output can differ by architecture.

If you'd rather start fresh, Kali offers weekly builds. They can mean fewer updates after install, but they are automated and don't go through the same QA as standard release images.

Kali on WSL​

BleepingComputer advises WSL users to use WSL 2 for better graphical-application support. You can check your version by running wsl -l -v in a Windows Command Prompt. This is a compatibility note for Kali on WSL, not a requirement of the release. Kali lists WSL among the targets its build scripts produce, so that image type falls under the refresh too.

NetHunter​

The release also includes a long NetHunter section. Highlights include wardriving support on the TicWatch Pro 3 series, an experimental "WearHunter" tool for controlling a NetHunter watch from a phone, NFC access to the Kali chroot, and KernelSU support. Several new device kernels were added too. This is mobile-focused and outside most Windows admins' day-to-day concerns, but it shows the project's range.

Bottom line​

For most readers, 2026.3 is a routine rolling snapshot. The new tools, the Plasma 6.7 desktop and the kernel bump are incremental. The build-script refresh is the change with lasting value, especially for labs that build custom or reproducible images. Test before you upgrade, mind the older workflow breakage, and don't expect every script to be uniform until 2026.4.