cross-posted from: https://lemmy.ml/post/46701277
I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update && apt upgrade, reboot, job done.
Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March.
I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.
You only need the reboot if a package update masks the retirement.
The system is not lying to you, it holds some critical updates back to be installed separately and manually.
The output shows you which packages have been held back. Just do apt-get install linux-image-amd64 for example, reboot and apt autoremove to remove the old kernel.
from my own experience,
apt dist-upgraderemoves old kernels,apt upgradestill installed the new kernel, grub updated and booted into the new kernel.all dist-upgrade did (for me) was delete the old kernels. which is something I would prefer not to do because it removes any ability to rollback should I absolutely need to.
You’re not supposed to run apt upgrade in Proxmox at all, it may even break your system. Use dist-upgrade.
https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#system_software_updates
I’m curious, how might
apt upgradebreak something in Proxmox?I don’t know, I’ve seen it several times mentioned in the Proxmox forum. I think it’s more of a theoretical scenario but it’s strongly advised against.
dist-upgrade and full-upgrade are essentially the same command but yeah, I won’t be using apt upgrade again in the future! Like I said in my post, the joys of being self taught is that you learn by my making mistakes and that’s part of the “fun” 🤣
Nah, the fun is learning form others mistakes. Thanks for a fun read :}
Not essentially, exactly. One is a deprecated alias for the other.
Which one is which?
I thought full-upgrade replaced dist-upgrade that could make you think you’re upgrading you distro to the next version
But now I’m not sure anymore.
Correct. Full-upgrade is the new term. It’s an alias, though, so using either will accomplish the same thing.
dist-upgrade was used with apt-get
full-upgrade is used for apt
Just don’t use any command in proxmox. Proxmox is designed GUI first. It got an update button in the GUI. Only major releases could need tinkering in the terminal. But even changing repos is now possible in the GUI.
Gets annoying soon if you have more than one host. Easily automated with Ansible
I mean, you could just use the proxmox UI for updates. Single point for all servers, just click in and hit update. It explicitly runs dist-upgrade already.
Hmm. Welp. Let’s try. See what happens.
I’ve seen that the patches are only available in the debian-security repository. It’s important to review your repo list in
/etc/apt/sources.list.d.Proxmox does not use the standard debian kernel.
Yes, I referred to the Debian part only.
The nice thing about zypper is the various patch options and reporting. Gives you a good picture of what CVEs, rating, and if installed, needed, not needed etc. Does Apt have something similar?
Ooof, scared me there for a second. Good thing I am using Dist-Upgrade in my ansible scripts.
