RHEL, AlmaLinux, Rocky and Oracle Linux: security updates

Updated November 2026

On RHEL 8, 9 and 10 and their rebuilds (AlmaLinux, Rocky Linux, Oracle Linux), sudo dnf upgrade --security installs every pending security fix. Then run sudo dnf needs-restarting -r to see if the server must reboot. The commands are the same on all four distributions; only the advisory names and websites differ.

Supported releases and end of life

As of November 2026, these releases still get security updates. Each date is the vendor's own. After it, a release gets no more free fixes.

Red Hat's full support phase (new features and hardware support) ended for RHEL 8 on May 31, 2024 and ends for RHEL 9 on May 31, 2027 and RHEL 10 on May 31, 2030. AlmaLinux and Rocky Linux use the same dates for "active support." Only the newest minor release of each major version is supported: at the time of writing that is 10.2, 9.8 and 8.10 on AlmaLinux and Rocky Linux. A normal dnf upgrade moves you to the newest minor release on its own.

Check which release you run

cat /etc/os-release
rpm -E %rhel        # prints the major version: 8, 9 or 10
uname -r            # the kernel that is running now

Apply security updates now

All four distributions put security metadata (an updateinfo file) in their repositories, so dnf knows which updates fix security issues. List what is missing:

sudo dnf updateinfo list --security        # security advisories not yet installed
sudo dnf updateinfo info RHSA-2026:1234    # details of one advisory (use a real ID)

Then install. Pick one line:

sudo dnf upgrade --refresh                       # everything (recommended for most servers)
sudo dnf upgrade --security                      # only updates that fix security issues
sudo dnf upgrade --security --sec-severity=Critical
sudo dnf upgrade --advisory=RHSA-2026:1234       # one advisory
sudo dnf upgrade --cve=CVE-2026-12345            # whatever fixes one CVE
sudo dnf upgrade-minimal --security              # lowest versions that fix the issues

Older Red Hat documentation writes these as dnf update; update is an older alias of upgrade and does the same thing. On RHEL 7 the tool is yum, and only the paid ELS add-on still delivers fixes.

Where advisories are published

Each rebuild republishes Red Hat's fixes under its own prefix. Security advisories start with SA; bug fix and enhancement advisories (such as ALBA and ALEA on AlmaLinux) do not fix vulnerabilities.

For one CVE across distributions, see our vulnerability pages.

Automatic security updates

dnf-automatic runs dnf from a systemd timer. On RHEL 8, 9 and 10 and the rebuilds (as root):

sudo dnf install dnf-automatic
sudo vi /etc/dnf/automatic.conf

In the [commands] section set:

upgrade_type = security

Then enable the timer that downloads and installs:

sudo systemctl enable --now dnf-automatic-install.timer
systemctl status dnf-automatic-install.timer

Other timers exist: dnf-automatic-notifyonly.timer only reports, dnf-automatic-download.timer downloads without installing. Recent dnf-automatic versions also accept reboot = when-needed; check man dnf-automatic on your release before relying on it. Without it, the server keeps running the old kernel until you reboot. See Automatic updates.

Is a reboot or restart needed?

sudo dnf needs-restarting -r     # exit code 1 = reboot needed (kernel, systemd and other core packages)
sudo dnf needs-restarting -s     # systemd services using old libraries
sudo systemctl restart sshd      # example: restarts one service
sudo systemctl reboot            # REBOOTS the server

If needs-restarting is missing, install dnf-plugins-core (or yum-utils). Updating OpenSSL without restarting nginx, sshd or your database leaves the old, vulnerable code in memory. More in Restarts and reboots.

Kernel updates and live patching

A new kernel only runs after a reboot. dnf keeps the previous kernels installed, so you can pick one in the boot menu if the new one fails. Compare uname -r with rpm -q kernel to see if you are behind.

RHEL: kpatch. Red Hat ships live patches for some Critical and Important kernel flaws as RPMs. They only cover the current minor release (on RHEL 10, from 10.2 onward), and they do not fix every CVE, so you still reboot in your next window.

sudo dnf install kpatch kpatch-dnf
sudo dnf kpatch auto     # subscribe current and future kernels
kpatch list              # loaded live patches

Oracle Linux: Ksplice. Ksplice patches the kernel and some user-space libraries such as glibc and OpenSSL without a reboot. It is included with Oracle Linux Premier Support and on Oracle Cloud Infrastructure.

sudo ksplice -n all upgrade    # list available updates
sudo ksplice -y all upgrade    # install them
sudo ksplice all show          # what is applied

On AlmaLinux and Rocky Linux, plan regular reboots, or look at commercial live patching services. See Kernel live patching.

Upgrading to a new major release

Minor releases arrive through dnf upgrade. Major releases (8 to 9, 9 to 10) need an in-place upgrade tool or a fresh install. Upgrades go one major version at a time. Back up or snapshot first and try it on a copy.

RHEL: Leapp. Red Hat supports, for example, RHEL 9.8 to RHEL 10.2 and RHEL 9.6 (EUS) to 10.0. As root:

dnf install leapp-upgrade
leapp preupgrade --target 10.2     # read /var/log/leapp/leapp-report.txt and fix blockers
leapp upgrade --target 10.2
reboot                             # REBOOTS into the upgrade

AlmaLinux and CentOS: ELevate. The AlmaLinux ELevate project uses Leapp to upgrade CentOS 7 to EL 8, AlmaLinux or CentOS Stream 8 to EL 9, and AlmaLinux or CentOS Stream 9 to EL 10:

sudo yum update -y && sudo reboot   # start fully updated (REBOOTS)
sudo yum install -y http://repo.almalinux.org/elevate/elevate-release-latest-el$(rpm --eval %rhel).noarch.rpm
sudo yum install -y leapp-upgrade leapp-data-almalinux
sudo leapp preupgrade                # fix what /var/log/leapp/leapp-report.txt lists
sudo leapp upgrade
sudo reboot                          # REBOOTS into the upgrade

The quickstart uses yum so the same steps work on CentOS 7. Swap leapp-data-almalinux for the data package of your target (for example leapp-data-centos for CentOS Stream), as listed in the ELevate quickstart.

If your release is end of life

• RHEL 7: buy the ELS add-on (to May 31, 2029) or upgrade with Leapp now.
• Oracle Linux 7: Premier Support ended in December 2024; paid Extended Support runs to July 2029. Plan the move to 8, 9 or 10.
• Old minor release (for example 9.6 on AlmaLinux): run sudo dnf upgrade to reach the supported minor.
• Until you upgrade: firewall the server, close unused services and watch advisories.

CentOS Linux users should read CentOS. Dates for every OS are on Is my OS supported?.

Sources

• Red Hat Enterprise Linux Life Cycle, Red Hat
• Product Life Cycles: Red Hat Enterprise Linux (incl. legacy RHEL 7), Red Hat
• RHEL 10: Managing and monitoring security updates, Red Hat
• RHEL 10: Applying patches with kernel live patching, Red Hat
• Upgrading from RHEL 9 to RHEL 10, Red Hat
• AlmaLinux release notes and support dates, AlmaLinux OS Foundation
• AlmaLinux errata, AlmaLinux Wiki
• ELevate quickstart guide, AlmaLinux Wiki
• Rocky Linux releases, Rocky Linux documentation
• Lifetime Support Policy: Oracle Open Source Service Offerings (PDF), Oracle
• About Oracle Ksplice, Oracle
• Using the ksplice command, Oracle
• DNF command reference (updateinfo, --security, upgrade-minimal)
• dnf-automatic documentation
• dnf needs-restarting, DNF plugins core