I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update && apt upgrade, reboot, job done.
Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March.
I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.
apt dist-upgrade is a necessary change to your process in place of just upgrade.
Thanks for sharing this. I’m very confident with Linux, but I hadn’t thought about this!
Your blog post was concise, too. I hate scrolling forever before finding the solution.
Glad you found it useful. I’m the same, I can’t stand those long posts that make you read a life story before getting to the commands, even worse when a page is riddled by ads or behind a paywall!
I figured if I’d missed it, a few other people probably had too.
Shouldn’t the upgrade also update the bootloader’s default entry to a new kernel? The way I’ve been doing it was apt update && apt dist-upgrade. And then reboot once every 1 to 2 years if I feel like it, am bored, or there’s all these news articles about a severe bug in the kernel.
Uhm, you dont update the host OS??
I’m the same way. My Debian server is two versions out of date, but it’s still getting security updates and works, so why in the world would I upgrade?
Because the kernel and packages are severely outdated, only getting urgent patches
Why?
Shouldnt an updater run on the host? And Debian should always update the kernel with apt?
Yeah, apt is an unwieldy piece of shit.
is this specific to apt? dnf or pacman dont suffer from this?
I’ve not come across this with my non Debian based systems. Only use Debian for servers because it’s so stable, Arch and Fedora everywhere else!
I don’t know for certain but this seems pretty apt specific.
I’d say Python is instead.
?
I’m sorry, wrong thread.
