Patching Linux servers: distribution guides

Updated November 2026

Every Linux distribution has its own release schedule, package manager and advisory feed. The table below gives the one command that installs pending security fixes on each, which releases still get fixes as of November 2026, and where the vendor announces new vulnerabilities.

Quick reference

Run the commands as root or with sudo. On a release that is out of support, the command still runs but installs nothing new, because no fixes are being published. Check the release first.

Linux distributions: supported releases and security-update commands (as of November 2026)
DistributionSupported releasesPackage managerInstall security updatesAdvisories
Debian13 “trixie”; 12 “bookworm” (LTS until June 30, 2028)aptsudo apt update && sudo apt upgradedebian.org/security
Ubuntu26.04, 24.04 and 22.04 LTS; 26.10 interim; older LTS releases with Ubuntu Proaptsudo apt update && sudo apt upgradeubuntu.com/security/notices
Red Hat Enterprise Linux10 (latest minor 10.2), 9 (9.8), 8 (8.10)dnfsudo dnf upgrade --securityRed Hat Customer Portal
CentOS Stream10 (until May 31, 2030), 9 (until May 31, 2027)dnfsudo dnf upgradeSee the CentOS guide
Fedora Linux44 (released April 28, 2026) and 43; 45 is scheduled for November 3, 2026dnfsudo dnf upgrade --refreshSee the Fedora guide
SUSE Linux Enterprise Server16, 15 SP7zyppersudo zypper patch --category securitySUSE update advisories
Amazon LinuxAmazon Linux 2023 (until June 2029); Amazon Linux 2 ended June 30, 2026dnfsudo dnf check-release-update, then sudo dnf upgrade --releasever=latestAmazon Linux Security Center
Arch LinuxRolling release (only the current state of the repositories is supported)pacmansudo pacman -Syusecurity.archlinux.org
Alpine Linux3.24, 3.23, 3.22 (3.21 ended November 1, 2026)apkapk update && apk upgrade (as root)security.alpinelinux.org

Two releases just went out of support. Debian 11 “bullseye” left Debian LTS on August 31, 2026, and Amazon Linux 2 reached end of support on June 30, 2026. If you still run either, read the end-of-life section of the matching guide and Is my OS supported?.

The same five steps everywhere

  1. Know the release. Run cat /etc/os-release and compare it with the table above.
  2. Install the fixes. Use the command in the table, or a security-only variant where the distribution offers one.
  3. Restart what loaded the old code. A patched library does nothing for a process that still has the old copy in memory. See Restarts and reboots.
  4. Boot the new kernel. Kernel fixes need a reboot unless you use live patching. See Kernel updates and Kernel live patching.
  5. Automate the routine. Let the system install security updates daily and keep manual work for urgent cases. See Automatic updates.

For a single urgent vulnerability, start with Emergency patching and Check installed versions, and follow the vendor feeds listed in Security advisories.

Distribution guides

Sources