The Update Conundrum
the.unknown-universe.co.uk
How a “kept back” Proxmox kernel left my home lab exposed to CVE‑2026‑31431 — why I now check upgradable packages and use apt full‑upgrade.

cross-posted from: https://lemmy.ml/post/46701277

I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update && apt upgrade, reboot, job done.

Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March.

I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.

  • DigDoug@lemmy.worldEnglish
    1·
    27 days ago

    Is this just a Proxmox thing? I’m running Debian on my server, and as far as I know, the kernel has always upgraded properly when there’s a new one available.

    • TheIPW@lemmy.mlEnglish
      1·
      1 month ago

      dist-upgrade and full-upgrade are essentially the same command but yeah, I won’t be using apt upgrade again in the future! Like I said in my post, the joys of being self taught is that you learn by my making mistakes and that’s part of the “fun” 🤣

    • LeTak@feddit.orgEnglish
      0·
      1 month ago

      Just don’t use any command in proxmox. Proxmox is designed GUI first. It got an update button in the GUI. Only major releases could need tinkering in the terminal. But even changing repos is now possible in the GUI.

  • GreenKnight23@lemmy.worldEnglish
    0·
    29 days ago

    from my own experience, apt dist-upgrade removes old kernels, apt upgrade still installed the new kernel, grub updated and booted into the new kernel.

    all dist-upgrade did (for me) was delete the old kernels. which is something I would prefer not to do because it removes any ability to rollback should I absolutely need to.

    • oong3Eepa1ae1tahJozoosuu@lemmy.worldEnglish
      1·
      21 days ago

      Which distro? Debian for example always keeps two kernels: the curent one and the one in use before that, which is what I prefer, never had to rely on more than one backup kernel.