apt dist-upgrade is a necessary change to your process in place of just upgrade.

I cross posted this to !selfhosted@lemmy.world, I hope that was ok! I figured it would be good to spread the knowledge

When a kernel update requires a change in dependencies, something Proxmox kernels do frequently, apt just quietly “keeps back” the package. It doesn’t fail, it doesn’t break the system, and it doesn’t trigger a rollback. It just waits for me to notice.

This should save a click for hopefully everyone.

Yes obviously, if you do not update the packages then they do not get updated.

If you do not read the output of a command then you will not notuce that.

Thanks for sharing this. I'm very confident with Linux, but I hadn't thought about this!

Your blog post was concise, too. I hate scrolling forever before finding the solution.

pacman -Syu goes brrr

I had a similar experience with this vulnerability. I had no idea another command was required to update the kernel. Kind of odd if you ask me, but i'm sure they did it so you're forced to realize you're updating the kernel.

Shouldn't the upgrade also update the bootloader's default entry to a new kernel? The way I've been doing it was apt update && apt dist-upgrade. And then reboot once every 1 to 2 years if I feel like it, am bored, or there's all these news articles about a severe bug in the kernel.

apt just quietly “keeps back” the package. It doesn’t fail, it doesn’t break the system, and it doesn’t trigger a rollback. It just waits for me to notice. Since I wasn’t looking at the list of upgradable packages

Depends on what quietly means. To me it means "with no indication". Any written warning is quiet, I guess, if one is not reading it.

Would apt-get instead of apt have saved you?

This is specific to Debian and Ubuntu so why not being more specific in the title?

There’s no point in digital hoarding; it just clutters the boot partition and makes future updates messier.

I feel personally attacked.

Uhm, you dont update the host OS??

Yay!

You're not supposed to run apt upgrade in Proxmox at all, it may even break your system. Use dist-upgrade.

https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#system_software_updates

I've seen that the patches are only available in the debian-security repository. It's important to review your repo list in /etc/apt/sources.list.d.

Hmm. Welp. Let’s try. See what happens.

I mean, you could just use the proxmox UI for updates. Single point for all servers, just click in and hit update. It explicitly runs dist-upgrade already.

Is this just a Proxmox thing? I'm running Debian on my server, and as far as I know, the kernel has always upgraded properly when there's a new one available.

The nice thing about zypper is the various patch options and reporting. Gives you a good picture of what CVEs, rating, and if installed, needed, not needed etc. Does Apt have something similar?

I honestly don't know what your talking about. proxmox updated the pve kernels immediately after this CVE was published....

additionally, this CVE only applies to older (pre-6.17 kernels). unless you are on proxmox 8 or earlier, you are already running a "patched" kernel as the pathway necessary for this was changed and in kernel 7.x and above this CVE doesnt work...

from my own experience, apt dist-upgrade removes old kernels, apt upgrade still installed the new kernel, grub updated and booted into the new kernel.

all dist-upgrade did (for me) was delete the old kernels. which is something I would prefer not to do because it removes any ability to rollback should I absolutely need to.