After patching: which services to restart and when to reboot

Updated November 2026

An update replaces files on disk, not code that is already running. A service started before the update keeps using the old, vulnerable library until you restart it, and the old kernel keeps running until you reboot. Patching is only finished when nothing old is still in memory.

Why installing is not enough

When the package manager updates a shared library such as libssl, it writes a new file and deletes the old one. Programs that loaded the old file still have it mapped in memory. The file is gone from the directory, but its contents stay in use until the last process holding it exits.

Example: OpenSSL is updated at 10:00. Your web server has been running since last month. Until you restart it, every TLS connection is still handled by the old library, so the fix does nothing for that service. The same is true for the mail server, the VPN daemon and anything else linked to OpenSSL.

The kernel is different again: no restart of any service can replace it. A new kernel is used only after a reboot, unless you use live patching.

The quick check for each family

Commands to find what still needs a restart
System	Services to restart	Reboot needed?
Debian, Ubuntu	`sudo needrestart -r l`	`sudo needrestart -k`, or the file `/var/run/reboot-required`
RHEL, Alma, Rocky, Oracle Linux, Fedora	`sudo dnf needs-restarting -s`	`sudo dnf needs-restarting -r`
SUSE, openSUSE	`sudo zypper ps -s`	`sudo zypper needs-rebooting`
Any Linux	`sudo lsof -n \| grep DEL`	Compare `uname -r` with the newest installed kernel

Run the check as root. Without root, the tools cannot see processes owned by other users and will miss most services.

Debian and Ubuntu: needrestart

needrestart looks for processes that use deleted libraries, outdated interpreter scripts (Perl, Python, Ruby, Java), an outdated kernel and, on Intel and AMD CPUs, outdated microcode. Install it with sudo apt install needrestart if it is missing.

# list services that need a restart, change nothing
sudo needrestart -r l

# check only the kernel
sudo needrestart -k

# restart affected services automatically (RESTARTS SERVICES)
sudo needrestart -r a

For scripts and monitoring, batch mode (-b) never restarts anything and prints lines such as NEEDRESTART-SVC: nginx.service. The NEEDRESTART-KSTA value tells you the kernel state: 1 means no pending upgrade, 2 means an ABI-compatible upgrade is pending, 3 means a new kernel version is pending, and 0 means it could not tell.

Ubuntu 24.04 and later. needrestart restarts affected services automatically by default after apt runs. On Debian the default mode is interactive, and it falls back to list-only when run without a terminal, for example from unattended-upgrades.

needrestart deliberately does not restart some services, even in automatic mode. Its default configuration excludes D-Bus, display managers, getty consoles, NetworkManager, Docker and libvirt, because restarting them can cut off sessions, networking or guests. If they show up as outdated, plan a reboot.

The reboot-required flag

On Ubuntu, packages that need a reboot (the kernel, for example) create /var/run/reboot-required and list themselves in /var/run/reboot-required.pkgs. On Debian, the unattended-upgrades package installs a kernel hook that does the same after a kernel install. unattended-upgrades checks this file when automatic reboots are turned on.

[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs

The flag only covers packages that set it. It says nothing about services using old libraries, so run needrestart as well.

RHEL family and Fedora: needs-restarting

# systemd services that use updated files
sudo dnf needs-restarting -s

# is a reboot recommended? exit code 1 = yes, 0 = no
sudo dnf needs-restarting -r; echo "exit code: $?"

# restart one service from the list (RESTARTS THE SERVICE)
sudo systemctl restart httpd.service

There are two versions of this command. The DNF 4 plugin (from dnf-plugins-core) lists processes when run without options; -r reports only whether a reboot is needed. The DNF 5 version (current Fedora releases) checks for a needed reboot by default, accepts -r only for compatibility, lists processes with -p, and with -s returns exit code 1 if any service needs a restart. In DNF 5, a reboot is recommended when the kernel, systemd or another core package was updated since boot, or when an advisory is marked "reboot suggested". If the command is missing on an older system, install dnf-plugins-core.

SUSE: zypper ps

# processes using deleted files, short table
sudo zypper ps -s

# only processes that belong to a system service
sudo zypper ps -ss

# just the service names
sudo zypper ps -sss

# exit code 102 = reboot suggested, 0 = not needed
sudo zypper needs-rebooting; echo "exit code: $?"

zypper ps -sss prints one service name per line, which makes it easy to feed into systemctl restart after you have read the list.

Any Linux: lsof

If none of the tools above is available, lsof shows deleted files that are still open or mapped.

# mapped files that were deleted (old libraries show as DEL)
sudo lsof -n 2>/dev/null | grep DEL

# all open files whose link count is below 1 (unlinked)
sudo lsof -n +L1

In the first command, DEL marks a memory-mapped file that has been deleted. Look for paths ending in .so plus a version number; the first column names the program to restart. The second command also lists harmless temporary files that programs delete on purpose, so read it with care.

glibc, OpenSSL and other core libraries

Some updates touch almost every process:

glibc (the C library) is used by nearly everything. Restarting every service one by one is close to a reboot anyway, and some processes, such as PID 1 and your login shell, cannot simply be restarted. Reboot.
OpenSSL is used by web, mail, database, VPN and SSH services. Restart all of them, or reboot. After restarting sshd, your current SSH session still runs the old code; log out and back in.
systemd, D-Bus and the kernel: reboot. These are the cases where the tools above say a reboot is recommended.
CPU microcode and firmware updates also need a reboot to take effect.

Canonical's Livepatch documentation makes the same point: even with kernel live patching, updates to shared libraries such as glibc, microcode and firmware need a reboot.

Containers

Host tools see processes inside containers, but restarting them is a different job. needrestart ignores Docker containers by design, because software inside a Docker container is not updated in place. For LXC and systemd-nspawn (machined) containers it can restart the whole container.

For image-based containers, the fix is to rebuild the image on an updated base image and redeploy it. Updating packages on the host does nothing for libraries inside the image. See Containers.

When to reboot

Reboot when any of these is true:

A new kernel was installed and you do not use live patching, or the fix is not covered by a live patch.
glibc, systemd, D-Bus or microcode was updated.
The tools report services that are excluded from automatic restart.
Many libraries changed at once and you cannot easily tell what uses them.

A reboot is the one check that cannot miss anything. If uptime matters, put two or more servers behind a load balancer and reboot them one at a time. For safe remote reboots and rollback, see Kernel updates.

A routine that works

Install updates (see Emergency patching).
Run the restart check for your system and read the list.
Restart the listed services, or reboot if a core component changed.
Run the check again. It should come back empty.
Confirm the services are healthy: systemctl --failed should list nothing new.