Turns out I have been updating wrong all this time! 🤦🏼

2026-05-02 02:41 UTC

cross-posted from: lemmy.ml/post/46701277 I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update &amp;&amp; apt upgrade, reboot, job done. Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March. I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.

Replies (10)

@DigDoug@lemmy.world 2026-05-06 20:38

Is this just a Proxmox thing? I'm running Debian on my server, and as far as I know, the kernel has always upgraded properly when there's a new one available.

Open ##2128779
@endlesseden@pyfedi.deep-rose.org 2026-05-06 11:35

I honestly don't know what your talking about. proxmox updated the pve kernels immediately after this CVE was published.... additionally, this CVE only applies to older (pre-6.17 kernels). unless you are on proxmox 8 or earlier, you are already running a "patched" kernel as the pathway necessary for this was changed and in kernel 7.x and above this CVE doesnt work...

Open ##2128781
@Nomad@infosec.pub 2026-05-04 19:16

You only need the reboot if a package update masks the retirement. The system is not lying to you, it holds some critical updates back to be installed separately and manually. The output shows you which packages have been held back. Just do apt-get install linux-image-amd64 for example, reboot and apt autoremove to remove the old kernel.

Open ##2128782
@GreenKnight23@lemmy.world 2026-05-04 19:09

from my own experience, `apt dist-upgrade` removes old kernels, `apt upgrade` still installed the new kernel, grub updated and booted into the new kernel. all dist-upgrade did (for me) was delete the old kernels. which is something I would prefer not to do because it removes any ability to rollback should I *absolutely* need to.

Open ##2128783
@tofu@lemmy.nocturnal.garden 2026-05-02 03:01

You're not supposed to run apt upgrade in Proxmox at all, it may even break your system. Use dist-upgrade. https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#system_software_updates

Open ##2128784
@KairuByte@lemmy.dbzer0.com 2026-05-02 20:16

I mean, you could just use the proxmox UI for updates. Single point for all servers, just click in and hit update. It explicitly runs dist-upgrade already.

Open ##2128785
@Mister_Hangman@lemmy.world 2026-05-02 06:44

Hmm. Welp. Let’s try. See what happens.

Open ##2128786
@suzune@ani.social 2026-05-02 04:07

I've seen that the patches are only available in the debian-security repository. It's important to review your repo list in `/etc/apt/sources.list.d`.

Open ##2128788
@BCsven@lemmy.ca 2026-05-02 16:27

The nice thing about zypper is the various patch options and reporting. Gives you a good picture of what CVEs, rating, and if installed, needed, not needed etc. Does Apt have something similar?

Open ##2128789
@prenatal_confusion@feddit.org 2026-05-02 08:50

Ooof, scared me there for a second. Good thing I am using Dist-Upgrade in my ansible scripts.

Open ##2128791