It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on all Linux kernels.
Linux distributions support the parallel installation of multiple kernel versions. When installing a new kernel, a boot entry and an
initrd are automatically created, so no further manual configuration is needed. Do I really need then to be concerned about vulnerabilities discovered for older installed kernels (which are in fact not used to boot the system)? Is there any risk involved? I mean, sure one could probably argue that once someone gets access to the server he/she could boot into an older (more vulnerable if you will) installed kernel version but that would require root privileges in the first place.