Linux · medium · Access, hardening & packages

Automatic updates broke something, or are not running at all

Either updates are being applied without a restart so the fixes are not live, or an update has changed something at three in the morning.

What you see

A service behaves differently after a night with no deployment, or a security scan reports vulnerabilities that are supposedly patched.

What is actually wrong

Packages are updated but the running processes still hold the old libraries in memory. Or automatic updates are installed but never enabled, so nothing has been patched in months.

Codes and articles

unattended-upgradesdnf-automaticneedrestartkernel needs restartPending kernel upgrade

Fixes (2)

Confirm updates are actually being applied

Root shell25 minutesmedium riskreversible

Nothing appears to be patched.

Check whether it is enabled and when it last ran.

Shell

systemctl list-timers apt-daily* dnf-makecache* dnf-automatic* --allsudo tail -20 /var/log/unattended-upgrades/unattended-upgrades.log 2>/dev/null

Check the configuration is actually turning it on. Installing the package does not enable it on every distribution.
Shell
```
cat /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/nullgrep -vE '^\s*(#|$)' /etc/dnf/automatic.conf 2>/dev/null
```

Enable it for security updates.

Shell

sudo dpkg-reconfigure -plow unattended-upgradessudo systemctl enable --now dnf-automatic-install.timer

Check what is running with libraries that have since been replaced — this is the gap that makes a patched machine still vulnerable.
Shell
```
sudo needrestart -b 2>/dev/null || sudo dnf needs-restarting -r
```
A library updated on disk does not affect a process that already mapped the old one. Until those services are restarted, the vulnerability is still present in memory and no package list will show it.
Restart the affected services, or schedule a reboot where the kernel has been updated.
Shell
```
sudo needrestart -r a
```

Confirm it workedThe timer is active, the log shows recent installs, and nothing needs restarting.

Shell

systemctl list-timers | grep -Ei 'unattended|dnf-automatic'sudo needrestart -b 2>/dev/null | tail -5

If you need to undo itDisable the timer to stop automatic updates.

Constrain what automatic updates may change

Root shell30 minutesmedium riskreversible

An update changed something unexpectedly.

Find out exactly what was installed and when.

Shell

grep -E ' install | upgrade ' /var/log/dpkg.log | tail -30sudo dnf history list | head -10

Roll back the specific transaction if the package manager supports it.
Shell
```
sudo dnf history undo 42
```
On apt, downgrade the specific package and hold it while you investigate.
Shell
```
sudo apt install package=1.2.3-1sudo apt-mark hold package
```
A hold stops that package updating while leaving everything else current. Disabling automatic updates entirely to stop one package is a much larger trade than it looks — it stops the security updates too.

Restrict automatic updates to the security repository only.

Shell

grep -A5 'Allowed-Origins' /etc/apt/apt.conf.d/50unattended-upgrades

Add a blacklist entry for anything that must never update unattended.

Shell

sudo sed -i '/Package-Blacklist/,/};/ s|//\s*"vim";|  "custom-app";|' /etc/apt/apt.conf.d/50unattended-upgrades

Remember to review holds periodically — a held package is an unpatched package.
Shell
```
apt-mark showholdsudo dnf versionlock list 2>/dev/null
```

Confirm it workedThe service works, the package is held at the known-good version, and security updates still apply.

Shell

apt-mark showhold; systemctl list-timers | grep -i unattended

If you need to undo itsudo apt-mark unhold package releases the hold.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.