Fedora security updates and release upgrades

Updated November 2026

To patch Fedora, run sudo dnf upgrade --refresh and reboot if the kernel or a core library changed. Each Fedora release only gets updates for about 13 months, so you also have to upgrade to a new release roughly once a year with dnf system-upgrade.

Supported releases and end of life

Fedora releases a new version about every six months, aimed at late April and late October. Release N is supported until four weeks after release N+2 comes out. That gives each release about 13 months.

Fedora releases (as of November 2026)
Release	Released	End of life (scheduled)
Fedora 45	Scheduled for November 3, 2026	December 8, 2027
Fedora 44	April 28, 2026	June 2, 2027
Fedora 43	October 28, 2025	Early December 2026 (four weeks after Fedora 45)
Fedora 42	–	Ended May 27, 2026

End-of-life dates move if a release ships late, so check Fedora's schedule before you plan. Once Fedora 43 reaches end of life, a Fedora 43 server gets no more fixes.

Fedora on servers. Fedora's own documentation points people who want a slower pace and longer support to CentOS Stream or RHEL. If you cannot upgrade twice a year or at least once a year, a ten-year distribution such as RHEL, AlmaLinux or Rocky Linux (see RHEL, Alma, Rocky, Oracle) may suit better.

Check which release you run

cat /etc/fedora-release      # e.g. "Fedora release 44 (Forty Four)"
rpm -E %fedora               # just the number
uname -r                     # running kernel

Fedora 41 and later use DNF5. The commands below are for DNF5; most also work with the older DNF 4.

Apply security updates now

sudo dnf upgrade --refresh

--refresh makes dnf fetch fresh repository metadata first, so you do not miss an update published in the last few hours. On Fedora this is the normal way to patch: updates come as a stream of new upstream versions, and installing all of them is what Fedora tests.

Only security updates

Fedora updates are published through its Bodhi update system, and each one is typed as security, bugfix, enhancement or new package. dnf can filter on that:

dnf advisory list --security              # security advisories you still need
dnf advisory info FEDORA-2026-0123456789  # details (use a real advisory ID)
sudo dnf upgrade --security               # install only security updates
sudo dnf upgrade --advisories=FEDORA-2026-0123456789
sudo dnf upgrade --cves=CVE-2026-12345

dnf updateinfo still works as an alias of dnf advisory. --cves only finds an update if its advisory names that CVE. Use security-only updates for an urgent fix, and do a full upgrade soon after.

Where Fedora publishes advisories

Bodhi security updates: every security update, with its advisory ID (FEDORA-YYYY-…), the bugs it fixes and whether it is still in testing or already stable.
package-announce mailing list: announcements of Fedora package updates.

For a single CVE across distributions, see our vulnerability pages.

Automatic updates

Fedora's documentation advises against automatic updates on critical servers that cannot tolerate unplanned downtime. For other machines (as root or with sudo):

sudo dnf install dnf5-plugin-automatic
sudo nano /etc/dnf/automatic.conf

By default it only downloads. To install, and reboot only when needed, set:

[commands]
apply_updates=True
reboot=when-needed
# optional: only updates with a security advisory
upgrade_type=security

reboot=when-needed REBOOTS the server automatically (by default with a five-minute warning) after kernel or systemd updates; leave it out to reboot yourself. Then start the daily timer:

sudo systemctl enable --now dnf5-automatic.timer
systemctl status dnf5-automatic.timer

What it installed is logged in /var/log/dnf5.log. More options are in Automatic updates.

Is a reboot or restart needed?

sudo dnf needs-restarting        # exit code 1 = reboot recommended
sudo dnf needs-restarting -s     # systemd services to restart
sudo systemctl restart nginx     # example: restarts one service
sudo systemctl reboot            # REBOOTS the server

Without options, needs-restarting checks whether the kernel, systemd or another core package changed since boot. The command comes from the dnf5-plugins package. A new kernel only runs after a reboot, so compare uname -r with rpm -q kernel. See Kernel updates and Restarts and reboots.

Upgrade to a new Fedora release

Do this before your release reaches end of life. Back up first. dnf downloads everything while the system runs, then reboots into a special mode to install it, then reboots again into the new release.

sudo dnf upgrade --refresh                       # 1. fully update the current release
sudo systemctl reboot                            #    REBOOTS
sudo dnf system-upgrade download --releasever=45 # 2. download the new release
sudo dnf offline reboot                          # 3. REBOOTS at once and installs

Notes:

Do not skip step 1: the updates bring the signing keys for newer releases and fixes for the upgrade itself.
Upgrades are tested across at most two releases (for example 43 to 45). From older releases, go in steps.
If third-party packages block the upgrade, dnf asks for --allowerasing. Read the list of packages it would remove before you agree.
sudo dnf offline clean cancels a downloaded upgrade.
Fedora 40 and older (DNF 4) use sudo dnf system-upgrade reboot for step 3.
dnf offline reboot gives no countdown or confirmation, so stop services cleanly first.

After the upgrade:

cat /etc/fedora-release                 # confirm the new release
sudo dnf install rpmconf && sudo rpmconf -a   # review .rpmnew / .rpmsave config files
sudo dnf install remove-retired-packages
remove-retired-packages                 # add the old number (e.g. 43) if you skipped a release

Check /etc/ssh/sshd_config after rpmconf: if you accept the packaged file, your SSH settings return to Fedora's defaults.

If your release is end of life

Upgrade now with the steps above; from an old release, go up two versions at a time.
If the upgrade fails, reinstall the current release and restore data and configuration.
Until then, limit network exposure and watch advisories for software you run.

Dates for other systems are on Is my OS supported?.