Core system packages: sudo, glibc, systemd, polkit and the kernel

Updated November 2026

sudo, glibc, systemd, polkit and the kernel run on nearly every Linux server, and most local privilege escalation bugs land in one of them. Installing the update is only half the job: glibc, systemd and kernel fixes do nothing until you reboot, and polkit needs its daemon restarted.

Why these packages matter

sudo

Lets permitted users run commands as root. It is a setuid-root program (it always starts with root rights), so a bug can turn any local account into root.

glibc

The GNU C library (package libc6 on Debian and Ubuntu, glibc elsewhere). Almost every program on the system loads it, including PID 1, sshd and your web server.

systemd

The init system (PID 1) plus journald, udevd, logind, resolved and other services on most distributions.

polkit

Decides which unprivileged users may perform privileged actions over D-Bus. It has a daemon (polkitd) and the setuid helper pkexec.

The kernel

Everything runs on top of it. Kernel bugs can give root, escape containers or crash the machine.

Alpine uses musl instead of glibc and OpenRC instead of systemd, and FreeBSD has its own C library and init; on those systems only the sudo and kernel parts of this page apply.

Check the versions you run

sudo -V | head -1
ldd --version | head -1
systemctl --version | head -1
pkexec --version
uname -r                         # running kernel

These show upstream version numbers. Your distribution’s package version is what tells you whether a fix is included, because stable releases backport fixes without changing the upstream number:

# Debian, Ubuntu
dpkg-query -W sudo libc6 systemd polkitd pkexec 'linux-image-*'

# RHEL family, Fedora, SUSE
rpm -q sudo glibc systemd polkit kernel        # SUSE: kernel-default

On older Debian and Ubuntu releases polkit is packaged as policykit-1. dpkg-query reports packages that are not installed as errors; you can ignore those lines. To check one CVE, search the changelog, for example apt changelog sudo | grep CVE-2025-32463 or rpm -q --changelog sudo | grep CVE-2025-32463.

Upstream versions, as of November 2026

None of these projects is something you should normally build yourself on a server. Your distribution’s release lifecycle decides how long you get fixes; see the Linux pages for end-of-life dates.

Why updates need restarts or reboots

A package update replaces files on disk. Programs that are already running keep the old code in memory until they are restarted. The rule of thumb:

sudo and pkexec

Each sudo or pkexec command starts a new process from the file on disk, so the fix applies from the next run. Nothing needs restarting.

polkit

The polkitd daemon keeps running the old code until it is restarted. This restarts the polkit service:

sudo systemctl restart polkit

glibc

Every running process keeps the old library mapped until it exits, including PID 1 and processes you cannot easily restart. Restarting services one by one is almost a reboot anyway, so reboot. Restart tools such as needrestart or dnf needs-restarting will show nearly every service as affected.

systemd

Package scripts restart some systemd services, but PID 1 itself is a special case. The systemctl manual describes systemctl daemon-reexec as re-executing the manager, “of little use except for debugging and package upgrades”. Recent systemd versions also offer systemctl soft-reboot, which restarts all of userspace but leaves the kernel running; it is quicker than a reboot but still stops every service. If in doubt, reboot.

The kernel

The running kernel only changes when you boot a new one, or when a live patching service patches it in memory. Compare uname -r with the newest installed kernel. See Kernel updates and Kernel live patching.

sudo needrestart -r l              # Debian, Ubuntu: what needs a restart
sudo dnf needs-restarting -r       # RHEL family, Fedora: is a reboot needed?
sudo zypper needs-rebooting        # SUSE
sudo systemctl reboot              # reboots the server

Full details are in Restarts and reboots.

Apply the updates

For core packages, apply all pending security updates rather than picking single packages, because glibc, systemd and their libraries depend on each other.

# Debian, Ubuntu
sudo apt update
sudo apt upgrade

# RHEL, AlmaLinux, Rocky, Oracle Linux
sudo dnf upgrade --security

# Fedora
sudo dnf upgrade --refresh

# SUSE, openSUSE Leap
sudo zypper refresh
sudo zypper patch --category security

# Alpine (as root): sudo and the kernel
apk -U upgrade

# FreeBSD (as root): sudo is a package, the kernel is base
pkg upgrade sudo
freebsd-update fetch install

Then reboot if glibc, systemd or the kernel changed. Your distribution page has the exact details: Debian, Ubuntu, RHEL, SUSE, FreeBSD.

Notable recent advisories

Backports change the picture per distribution. For CVE-2025-32463, Debian marks bookworm and bullseye as not affected (the vulnerable code came later), while trixie was fixed in 1.9.16p2-3+deb13u2. For CVE-2025-4802, Debian bookworm was fixed in 2.36-9+deb12u14. Always check your distribution’s tracker. In 2026 systemd also published several local advisories for homed, machined, oomd, journald and nsresourced (August to October 2026); see the systemd advisories page.

Kernel security fixes arrive in nearly every stable update; on 2026-10-30 kernel.org released new versions of all six long-term branches on the same day. Tracking kernel CVEs one by one is not practical, so take your distribution’s kernel updates promptly and reboot, or use live patching between reboots. See also the vulnerability list.

Where advisories are published

• sudo: sudo security advisories.
• glibc: announced on the libc-announce mailing list; advisories from 2.39 on live in the advisories directory of the glibc git repository (see the glibc security process).
• systemd: GitHub security advisories and releases (including systemd-stable point releases).
• polkit: polkit releases.
• Your distribution: Ubuntu Security Notices (with RSS), the Debian security tracker, Red Hat and SUSE errata. See Security advisories.

Quick hardening tips

• Keep sudoers rules narrow. Avoid NOPASSWD: ALL for accounts that log in remotely, and review rules with sudo -l -U username.
• Edit sudoers only with visudo, which checks the syntax before saving.
• Do not rely on host names in sudoers as a security boundary, and do not use the deprecated --chroot option.
• List setuid programs with sudo find / -xdev -perm -4000 -type f and remove packages you do not need (for example pkexec on a server with no polkit users).
• Schedule regular reboot windows so glibc, systemd and kernel fixes actually take effect.
• Restrict physical and virtual device access (USB, iSCSI targets) on servers, as udev processes data from attached devices.
• Run a restart check after every patch run and alert on long uptimes after kernel updates.

Sources

• Security advisories, sudo project
• Local Privilege Escalation via chroot option, sudo project
• Local Privilege Escalation via host option, sudo project
• Sudo home page and news, sudo project
• glibc security process, GNU C Library project
• glibc release downloads, GNU project
• systemd security advisories, systemd project
• udev scsi_id advisory GHSA-m8q3-73v4-wvg7, systemd project
• PID 1 assertion advisory GHSA-848h-497j-8vjq, systemd project
• systemd releases, systemd project
• systemctl manual page, systemd project
• polkit releases, polkit project
• The Linux Kernel Archives, kernel.org
• CVE-2025-32463, Debian security tracker
• CVE-2025-4802, Debian security tracker
• CVE-2023-4911, Ubuntu security
• CVE-2021-4034, Ubuntu security
• Adopting sudo-rs by default in Ubuntu 25.10, Ubuntu Discourse