The core program managing hardware, memory, processes, and system calls for everything else running on the box.
The kernel is the one piece of software with direct, privileged access to the hardware. Every other program — your shell, your database, your browser — talks to hardware only by asking the kernel to do it on their behalf, through a system call. That boundary (user space vs. kernel space) is what keeps a crashing application from taking down the whole machine.
Linux specifically is a monolithic kernel with loadable modules: most core subsystems (scheduler, memory manager, networking stack) are compiled into one large kernel image, but device drivers and less-essential subsystems can be loaded and unloaded at runtime without a reboot.
Four jobs make up almost everything the kernel does: process scheduling (deciding which of potentially thousands of runnable processes gets the CPU next), memory management (virtual memory, paging, and the page cache), device drivers (talking to disks, NICs, GPUs through a uniform interface), and the system call interface (the ~300-400 well-defined entry points user-space programs are allowed to call into).
You can watch the kernel's live state without ever touching the source code, through two virtual filesystems it exposes: /proc for process and kernel runtime info, and /sys for the device/driver model. Neither is backed by real disk blocks — they're generated on the fly when you read them.
apt upgrade installs a newer one.