So a zImage is an ELF binary that also contains a gziped chunk of kernel image from which the kernel version should be easily extractable. file sees the ELF binary and stops (not unreasonably so). Why does get_kernel_version fail then on so many architectures on a zImage? Basically, it should scan the ELF file for a gzip header, decompress, proceed as it does for uncompresses kernel images on the decompressed data. Right?