I’ve been running my home lab since 2021 and honestly thought my update routine was solid: apt update && apt upgrade, reboot, job done.

Turns out I was wrong. I was checking CVE‑2026‑31431 (Copy Fail) this morning and realised that despite my “successful” updates, I was still running a vulnerable kernel from March.

I’ve had to rethink how I handle host updates. If you’re relying on a standard upgrade and a reboot to keep Proxmox or Debian hosts safe, you might want to check if yours is lying to you as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 6 months ago* (last edited 6 months ago)

Shouldn't the upgrade also update the bootloader's default entry to a new kernel? The way I've been doing it was apt update && apt dist-upgrade. And then reboot once every 1 to 2 years if I feel like it, am bored, or there's all these news articles about a severe bug in the kernel.

  • source