CentOS: end of life and how to stay patched

Updated November 2026

CentOS Linux is finished: CentOS Linux 8 reached end of life on December 31, 2021 and CentOS Linux 7 on June 30, 2024. Neither gets security fixes any more. If you still run one, move it to a supported system. CentOS Stream 9 and 10 are the only CentOS releases that still get updates.

June 30, 2024CentOS Linux 7 end of life
Dec 31, 2021CentOS Linux 8 end of life
May 31, 2027CentOS Stream 9 end of life
May 31, 2030CentOS Stream 10 end of life

CentOS releases and their dates

CentOS end-of-life dates (as of November 2026)
Release	End of life	Status
CentOS Linux 7	June 30, 2024	No updates; archived on vault.centos.org
CentOS Linux 8	December 31, 2021	No updates; last release was a rebuild of RHEL 8.5
CentOS Stream 8	May 31, 2024	No updates; archived on vault.centos.org
CentOS Stream 9	May 31, 2027	Supported
CentOS Stream 10	May 31, 2030	Supported

Each CentOS Stream release ends when the matching RHEL release leaves its five-year full support phase. That is much shorter than RHEL, AlmaLinux or Rocky Linux, which get security fixes for ten years (see RHEL, Alma, Rocky, Oracle).

Moving to vault.centos.org only keeps old packages downloadable. It does not bring fixes: a CentOS 7 server is exposed to every flaw found since June 2024.

Check what you are running

cat /etc/os-release
cat /etc/centos-release     # "CentOS Linux release 7.9.2009" or "CentOS Stream release 9"
uname -r

"CentOS Linux" means end of life. "CentOS Stream" means check the dates above.

Patching CentOS Stream

CentOS Stream is a rolling preview of the next RHEL minor release. It gets updates continuously, so you patch it with a normal full upgrade:

sudo dnf upgrade --refresh
sudo dnf needs-restarting -r     # exit code 1 = reboot needed
sudo systemctl reboot            # REBOOTS the server

No security-only updates on Stream. CentOS Stream 9 and 10 repositories carry no updateinfo security metadata. So dnf updateinfo list --security shows nothing and dnf upgrade --security installs nothing, even when fixes are waiting. Always apply all updates.

The same applies to automatic updates: in /etc/dnf/automatic.conf keep upgrade_type = default (not security), then:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

Kernel updates take effect only after a reboot. Read Restarts and reboots for services that must be restarted after library updates. Stream does not publish its own advisories, so read Red Hat's RHSA advisories and the CVE pages to judge how urgent a fix is.

Where to go from CentOS

You run	Supported targets and tools
CentOS Linux 7.9	RHEL 7.9 with convert2rhel (then ELS or a Leapp upgrade); AlmaLinux 8 with ELevate
CentOS Linux 8.4 / 8.5	RHEL 8.5 with convert2rhel (8.5 only); AlmaLinux with almalinux-deploy; Rocky Linux with migrate2rocky
CentOS Stream 8	CentOS Stream 9 or EL 9 with ELevate; AlmaLinux with almalinux-deploy; Rocky Linux with migrate2rocky
CentOS Stream 9	AlmaLinux with almalinux-deploy; Rocky Linux 9 with migrate2rocky9; EL 10 with ELevate

convert2rhel does not support CentOS Stream. Whatever you choose: take a backup or snapshot, try it on a copy first, and fully update the server before you start.

To RHEL with convert2rhel

Red Hat's convert2rhel swaps the packages for RHEL ones in place. You need a RHEL subscription. Install the tool as Red Hat's guide describes, then as root:

convert2rhel analyze     # report only; fix every problem it lists
convert2rhel             # does the conversion
reboot                   # REBOOTS the server

On CentOS 7, add --els to both commands if you want to stay on RHEL 7 under the paid Extended Life Cycle Support add-on (security fixes to May 31, 2029). If you upgrade to RHEL 8 straight after converting, you do not need ELS. CentOS 8 converts to RHEL 8.5; run dnf upgrade afterwards to reach a supported minor release.

To AlmaLinux

From CentOS 8.4 or later, or CentOS Stream 8, 9 or 10, use almalinux-deploy:

curl -O https://raw.githubusercontent.com/AlmaLinux/almalinux-deploy/master/almalinux-deploy.sh
sudo bash almalinux-deploy.sh      # add -f on CentOS 8 if its repositories are offline
sudo reboot                        # REBOOTS the server

From CentOS 7, use ELevate, which upgrades in place to AlmaLinux 8. The commands are on our RHEL page. Going on to AlmaLinux 9 and 10 is one ELevate run per major version.

To Rocky Linux

From CentOS 8 or CentOS Stream 8 (or 9, with migrate2rocky9.sh):

curl -O https://raw.githubusercontent.com/rocky-linux/rocky-tools/main/migrate2rocky/migrate2rocky.sh
chmod u+x migrate2rocky.sh
sudo ./migrate2rocky.sh -r
sudo reboot                        # REBOOTS the server

Rocky's guide warns that the script works best on clean installs and lists known clashes (for example with Katello repositories). Check hostnamectl after the reboot.

Reinstall

For old CentOS 7 servers, a fresh install of a supported release with your data and configuration copied over is often safer than two or three in-place upgrades in a row. It also gets rid of years of leftover packages.

Extended support for CentOS

If you cannot migrate soon, you have paid options:

RHEL 7 ELS: convert CentOS 7 to RHEL 7 and buy the ELS add-on (fixes to May 31, 2029).
Third-party extended updates: several companies sell security updates for CentOS 7 and CentOS 8 after end of life. Compare which packages they cover, how fast they ship fixes, and when their service ends.

Neither is a long-term plan. Both only buy time to migrate.

Until you migrate

Remove the server from direct internet exposure where you can; allow only the ports you need.
Turn off services you do not use.
Keep backups you can restore elsewhere.
Watch security advisories for software you run, especially OpenSSH, OpenSSL and the kernel.
Set a migration date and stick to it. See Is my OS supported? for other systems' dates.