Amazon Linux 2023 and Amazon Linux 2: security updates

Updated November 2026

On Amazon Linux 2023 (AL2023), a plain dnf upgrade often finds nothing, because each instance is locked to the repository version it was launched with. To get new security fixes you upgrade to a newer release version, usually with --releasever=latest. Amazon Linux 2 (AL2) reached end of support on 2026-06-30.

Supported releases

Amazon Linux support, as of November 2026
ReleaseStatusEnd date
Amazon Linux 2023Standard support (quarterly minor releases)Standard support ends June 30, 2027
Amazon Linux 2023Maintenance (security updates and critical bug fixes only)June 30, 2029
Amazon Linux 2End of supportEnded 2026-06-30
Amazon Linux 2027Preview, not for productionNot yet released

AWS says AL2 “is no longer receiving standard security updates” and tells customers to migrate to AL2023 now rather than wait for a future version.

Check your release

cat /etc/os-release
rpm -q system-release --qf "%{VERSION}\n"

On AL2023 the second command prints the repository version you are locked to, for example a date-stamped version such as 2023.12.20261021. That version is the releasever that dnf uses.

How AL2023 updates work

AWS calls this “deterministic upgrades through versioned repositories”. Each AL2023 release is a fixed snapshot of the package repository, and it never changes after release. New package updates, including security fixes, only appear in new repository versions. An instance launched from an older AMI therefore has to move to a newer version to get them. Older versions stay available, so a whole fleet can be moved to the same tested version.

dnf picks the version in this order: the --releasever= option on the command line, then the file /etc/dnf/vars/releasever if it exists, then the installed system-release package.

Apply security updates now

See which newer releases exist and what they would change:

sudo dnf check-release-update
dnf check-update --releasever=latest

dnf check-update returns exit code 100 when updates are available and 0 when there are none. AWS recommends applying all updates in a new release:

sudo dnf upgrade --releasever=latest

This updates every package, including system-release, so the instance is then locked to the new version. Add -y to skip the confirmation prompt in scripts.

Security-only updates

AL2023 supports them, although AWS says picking only security updates should be the exception. List and apply advisories from the latest release:

dnf updateinfo --releasever=latest --list
sudo dnf check-update --releasever=latest --security
sudo dnf upgrade --releasever=latest --security

To fix a single advisory with the smallest possible change, use the ID that dnf shows (for example ALAS2023-2024-581; the website writes the same advisory as ALAS-2024-581):

sudo dnf upgrade-minimal --releasever=latest --advisory ALAS2023-2024-581

Watch the version lock. If you install packages from a newer release without updating system-release, dnf stays locked to the old version. AWS warns that later installs can then fail on dependencies that changed in the newer release. Moving the whole system with dnf upgrade --releasever=latest avoids this.

Automatic updates

A scheduled dnf upgrade on a locked instance finds nothing new. AWS’s recommended options are:

You can also unlock an instance so every dnf command uses the newest release, which is how AL2 behaved:

echo latest | sudo tee /etc/dnf/vars/releasever

AWS warns that this removes the chance to test a release before it reaches production. Undo it with sudo rm /etc/dnf/vars/releasever. With the override in place, tools such as dnf-automatic (enabled with sudo systemctl enable --now dnf-automatic-install.timer, which downloads and installs) pick up new releases on their own.

Restart services and reboot

The smart-restart package restarts affected systemd services automatically after each dnf update, and leaves the marker file /run/smart-restart/reboot-hint-marker when it advises a reboot. Install it once:

sudo dnf install smart-restart

Note that it restarts services for you, which briefly interrupts them. Without it, ask dnf directly:

sudo dnf needs-restarting -r
sudo dnf needs-restarting -s

-r exits with 1 if a reboot is needed; -s lists services to restart. A kernel update always needs a reboot (sudo reboot restarts the instance). On EC2 bare-metal instances, CPU microcode updates also take effect only after a reboot; on virtualized instances the Nitro system handles microcode.

Kernel live patching

AL2023 offers kernel live patches at no extra cost on x86_64 and ARM64, for kernels 6.1, 6.12 and 6.18. They are off by default. Enable them:

sudo dnf install -y kpatch-dnf
sudo dnf kernel-livepatch -y auto
sudo dnf install -y kpatch-runtime
sudo systemctl enable kpatch.service && sudo systemctl start kpatch.service

Live patches then install with sudo dnf upgrade --security. Check them with sudo kpatch list, and see when your kernel stops getting them with sudo dnf kernel-livepatch support. Each kernel version gets live patches for only 3 months, and security live patches are best-effort: not every important or critical CVE gets one. Reboot into a new kernel regularly. See our live patching guide.

Where AWS publishes advisories

Still on Amazon Linux 2

AL2 has been out of support since 2026-06-30. sudo yum update --security still runs, but AWS no longer publishes standard security updates for it, so new vulnerabilities stay open.

See what to do with end-of-life systems for a step-by-step plan.

Sources