The application discloses a method and device used for restoring kernel vulnerability. The concrete embodiment of the method comprises following steps: collecting attribute information of a to-be-repaired kernel, wherein the attribute information comprises feature information used for representing a loading mode of codes supported by the to-be-repaired kernel; obtaining vulnerability restoring codes matched with the feature information, wherein the vulnerability restoring codes are used for calling a fix application programming interface which is used for enabling the vulnerability restoring codes to be adapted to kernel functions of different kernels; loading the vulnerability restoring codes and relocating instructions included in the vulnerability restoring codes; replacing addresses relocated by the fix application programming interface in the vulnerability restoring codes with addresses of the kernel functions called by the vulnerability restoring codes; and executing the vulnerability restoring codes with the addresses replaced to restore kernel vulnerability. The embodiment helps enlarge the application range of the vulnerability restoring codes such that the method and device used for restoring kernel vulnerability can be used for kernels in different models.