104
submitted 17 hours ago by TheIPW@lemmy.ml to c/linux@lemmy.ml

I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update && apt upgrade, reboot, job done.

Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March.

I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.

top 32 comments
sorted by: hot top new old
[-] SchwertImStein@lemmy.dbzer0.com 3 points 4 hours ago* (last edited 4 hours ago)

Would apt-get instead of apt have saved you?

[-] TheIPW@lemmy.ml 4 points 4 hours ago

No, apt isn’t just a rename. apt upgrade largely replaces apt-get upgrade, but it’s a bit more aggressive: it may install new packages if required as dependencies (it still won’t remove packages). If an upgrade needs to remove packages to resolve dependencies, use apt full-upgrade (same as apt-get dist-upgrade).

[-] otter@lemmy.ca 10 points 7 hours ago

I cross posted this to !selfhosted@lemmy.world, I hope that was ok! I figured it would be good to spread the knowledge

[-] mech@feddit.org 6 points 8 hours ago* (last edited 8 hours ago)

I've been running Debian since 2007 and never understood the point of apt upgrade .
When I update, I want the updated version for everything on my system.
I don't want to arbitrarily hold back packages just because a dependency changed. I'll decide for myself if that's an issue in my deployment. And Debian is generally very good at keeping everything running exactly the same way between releases.

I pin the release by name (not "stable") and then apt dist-upgrade always.

[-] Slashme@lemmy.world 1 points 59 minutes ago

I've always been doing apt dist-upgrade. What's the difference between dist-upgrade and full-upgrade?

[-] mech@feddit.org 1 points 50 minutes ago
[-] ShortN0te@lemmy.ml 16 points 10 hours ago

When a kernel update requires a change in dependencies, something Proxmox kernels do frequently, apt just quietly “keeps back” the package. It doesn’t fail, it doesn’t break the system, and it doesn’t trigger a rollback. It just waits for me to notice.

This should save a click for hopefully everyone.

Yes obviously, if you do not update the packages then they do not get updated.

If you do not read the output of a command then you will not notuce that.

[-] paris@lemmy.blahaj.zone 13 points 6 hours ago

The standard upgrade command has this behavior though, which is unexpected to people like me and the author. You need a specific flag to tell apt to actually upgrade everything which is not the behavior I expected.

[-] ShortN0te@lemmy.ml 0 points 1 hour ago

But it is clearly stated in the output that it holds back packages.

[-] racketlauncher831@lemmy.ml 3 points 8 hours ago

This is specific to Debian and Ubuntu so why not being more specific in the title?

[-] alsimoneau@lemmy.ca 2 points 7 hours ago
[-] BrightCandle@lemmy.world 29 points 17 hours ago

apt dist-upgrade is a necessary change to your process in place of just upgrade.

[-] mcheva@lemmy.dbzer0.com 3 points 8 hours ago

I may be wrong but I think it's apt-get dist-upgrade. apt full-upgrade does the same too.

[-] ATS1312@lemmy.dbzer0.com 6 points 7 hours ago

apt-get is now deprecated on Debian and Ubuntu. But otherwise, no notes.

[-] actionjbone@sh.itjust.works 12 points 16 hours ago

Thanks for sharing this. I'm very confident with Linux, but I hadn't thought about this!

Your blog post was concise, too. I hate scrolling forever before finding the solution.

[-] TheIPW@lemmy.ml 5 points 16 hours ago

Glad you found it useful. I'm the same, I can't stand those long posts that make you read a life story before getting to the commands, even worse when a page is riddled by ads or behind a paywall!

I figured if I’d missed it, a few other people probably had too.

[-] hendrik@palaver.p3x.de 6 points 17 hours ago* (last edited 14 hours ago)

Shouldn't the upgrade also update the bootloader's default entry to a new kernel? The way I've been doing it was apt update && apt dist-upgrade. And then reboot once every 1 to 2 years if I feel like it, am bored, or there's all these news articles about a severe bug in the kernel.

[-] boredsquirrel@slrpnk.net 4 points 17 hours ago

Uhm, you dont update the host OS??

[-] TheIPW@lemmy.ml 2 points 16 hours ago
[-] boredsquirrel@slrpnk.net 2 points 16 hours ago

Shouldnt an updater run on the host? And Debian should always update the kernel with apt?

[-] yesman@lemmy.world 1 points 16 hours ago

I'm the same way. My Debian server is two versions out of date, but it's still getting security updates and works, so why in the world would I upgrade?

[-] boredsquirrel@slrpnk.net 3 points 16 hours ago

Because the kernel and packages are severely outdated, only getting urgent patches

[-] RichardNixos@lemmy.ml 1 points 9 hours ago

This seems to me like a pretty urgent patch

[-] boredsquirrel@slrpnk.net 3 points 9 hours ago

Yes but there are tons of others that dont get CVEs lol

[-] chgxvjh@hexbear.net 2 points 17 hours ago

Yeah, apt is an unwieldy piece of shit.

[-] gary_host_laptop@lemmy.ml 2 points 16 hours ago

is this specific to apt? dnf or pacman dont suffer from this?

[-] thurstylark@lemmy.today 1 points 6 hours ago

I don't know about dnf, but pacman doesn't do this by default. The only way to hold back packages is by writing it in the configuration.

[-] TheIPW@lemmy.ml 1 points 16 hours ago

I've not come across this with my non Debian based systems. Only use Debian for servers because it's so stable, Arch and Fedora everywhere else!

[-] chgxvjh@hexbear.net 1 points 16 hours ago

I don't know for certain but this seems pretty apt specific.

[-] SocialistVibes01@lemmy.ml 1 points 17 hours ago

I'd say Python is instead.

[-] chgxvjh@hexbear.net 2 points 17 hours ago
[-] SocialistVibes01@lemmy.ml 3 points 17 hours ago

I'm sorry, wrong thread.

this post was submitted on 01 May 2026
104 points (96.4% liked)

Linux

64996 readers
469 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 7 years ago
MODERATORS