freeze kernel packages after they are updated