How to apply only security updates on AlmaLinux, Rocky Linux and RHEL with dnf

Frank Durieux — Sun, 18 Oct 2026 09:03:14 +0000

Unlike apt, dnf can tell security fixes apart natively: each distribution publishes advisories in its repositories (ALSA for AlmaLinux, RLSA for Rocky, RHSA for Red Hat) with a severity and a list of CVEs. Here is how to list them, apply only those or only the most severe, automate them with dnf-automatic and check whether a reboot is needed. Real output from AlmaLinux 9.8.

The short answer

Goal	Command
How many security advisories are pending?	`dnf updateinfo`
Which packages, which advisories?	`dnf updateinfo list security`
Simulate	`dnf upgrade --security --assumeno`
Apply	`dnf upgrade --security`
Only the most severe	`dnf upgrade --sec-severity=Critical` (or `Important`)
Automate	`dnf-automatic` with `upgrade_type = security`
Reboot needed?	`needs-restarting -r`

These commands behave the same on AlmaLinux and Rocky Linux 8, 9 and 10 (dnf 4.7 to 4.20). RHEL ships the same dnf versions. One exception, covered below: dnf-automatic's reboot option does not exist on version 8.

How do you list pending security updates?

Start with the summary, which counts advisories by severity:

$ dnf updateinfo
Updates Information Summary: available
    12 Security notice(s)
         7 Important Security notice(s)
         5 Moderate Security notice(s)

dnf check-update --security lists the packages involved. Its exit code is 100 when updates are available, 0 when there are none and 1 on error, which is handy in a monitoring check.

$ dnf check-update --security
coreutils-single.x86_64              8.32-41.el9_8.1                      baseos
curl-minimal.x86_64                  7.76.1-40.el9_8.7                    baseos
expat.x86_64                         2.5.0-6.el9_8.5                      baseos
(…)
openssl.x86_64                       1:3.5.8-1.el9_8                      baseos
openssl-libs.x86_64                  1:3.5.8-1.el9_8                      baseos
pam.x86_64                           1.5.1-28.el9_8.1                     baseos
vim-minimal.x86_64                   2:8.2.2637-26.el9_8.23               baseos
$ echo $?
100

dnf updateinfo list security (or list --security) adds the advisory ID and severity for each package. On this server, 14 security lines out of 18 pending updates (excerpt):

$ dnf updateinfo list security
ALSA-2026:66403 Moderate/Sec.  coreutils-single-8.32-41.el9_8.1.x86_64
ALSA-2026:69126 Important/Sec. curl-minimal-7.76.1-40.el9_8.7.x86_64
ALSA-2026:72663 Important/Sec. expat-2.5.0-6.el9_8.5.x86_64
ALSA-2026:73512 Moderate/Sec.  gawk-5.1.0-6.el9_8.1.x86_64
ALSA-2026:67165 Important/Sec. openssl-1:3.5.8-1.el9_8.x86_64
ALSA-2026:67165 Important/Sec. openssl-libs-1:3.5.8-1.el9_8.x86_64
ALSA-2026:64815 Moderate/Sec.  pam-1.5.1-28.el9_8.1.x86_64
(…)

# Rocky Linux 9: same commands, RLSA advisories
RLSA-2025:23343 Moderate/Sec.  binutils-2.35.2-67.el9_7.1.x86_64
RLSA-2025:0925  Moderate/Sec.  bzip2-libs-1.0.8-10.el9_5.x86_64

To filter by severity: dnf updateinfo list --sec-severity=Important. The levels are Critical, Important, Moderate and Low. To also show each advisory's CVEs: dnf updateinfo list --security --with-cve.

How do you read an advisory?

$ dnf updateinfo info ALSA-2026:67165
===============================================================================
  Important: openssl security, bug fix, and enhancement update
===============================================================================
  Update ID: ALSA-2026:67165
       Type: security
    Updated: 2026-09-15 08:35:12
       CVEs: CVE-2026-14456
           : CVE-2026-14457
(…)
Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, (…)
           : Security Fix(es):
           :   * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)

Each advisory gives its severity, the CVEs it fixes and one line per vulnerability: enough to judge how urgent it is, or to answer "is this server patched for that CVE?".

How do you simulate, then apply only security updates?

--assumeno resolves the transaction, prints it and answers "no" to the prompt:

$ sudo dnf upgrade --security --assumeno
Upgrading:
 coreutils-single        x86_64   8.32-41.el9_8.1             baseos      599 k
 curl-minimal            x86_64   7.76.1-40.el9_8.7           baseos      127 k
(…)
 openssl-fips-provider   x86_64   1:3.5.8-1.el9_8             baseos      813 k
 openssl-libs            x86_64   1:3.5.8-1.el9_8             baseos      2.3 M
 pam                     x86_64   1.5.1-28.el9_8.1            baseos      543 k
 vim-minimal             x86_64   2:8.2.2637-26.el9_8.23      baseos      675 k
Installing weak dependencies:
 gawk-all-langpacks      x86_64   5.1.0-6.el9_8.1             appstream   206 k

Transaction Summary
================================================================================
Install   1 Package
Upgrade  13 Packages

Total download size: 12 M
Operation aborted.

Note the "Installing weak dependencies" line: even limited to security, an update can install a package that wasn't there before (here a weak dependency of gawk). To prevent it: --setopt=install_weak_deps=False. Drop --assumeno to apply. Afterwards, only updates without a security advisory are left:

$ sudo dnf -y upgrade --security
(…)
$ dnf check-update
gnutls.x86_64                          3.8.10-9.el9_8                     baseos
systemd.x86_64                         252-67.el9_8.6.alma.1              baseos
systemd-libs.x86_64                    252-67.el9_8.6.alma.1              baseos
(…)

Can you target a severity, an advisory or a CVE?

# Only "Important" advisories (9 packages instead of 13 here)
sudo dnf upgrade --sec-severity=Important

# One specific advisory (openssl, openssl-libs, openssl-fips-provider)
sudo dnf upgrade --advisory=ALSA-2026:67165

# Packages that fix a given CVE
sudo dnf upgrade --cve=CVE-2026-14456

# The nearest fixed version rather than the latest one
sudo dnf upgrade-minimal --security

All four work with --assumeno so you can check before applying. --advisory picks exactly the advisory's packages (here, the three OpenSSL packages). upgrade-minimal --security produces the same transaction as upgrade --security when the repository only offers one fixed version per package.

How do you automate it with dnf-automatic?

dnf-automatic reads /etc/dnf/automatic.conf. The setting that matters is upgrade_type:

# /etc/dnf/automatic.conf, [commands] section (excerpt, as shipped on AlmaLinux 9)
#  What kind of upgrade to perform:
# default                            = all available upgrades
# security                           = only the security upgrades
upgrade_type = security          # shipped as "default"
random_sleep = 0
download_updates = yes
apply_updates = no
reboot = never

The package ships four systemd timers. dnf-automatic-install.timer downloads and installs regardless of apply_updates; dnf-automatic.timer follows the configuration file; -download and -notifyonly only download or notify. On AlmaLinux 9:

$ sudo dnf install dnf-automatic
$ sudo sed -i 's/^upgrade_type = default/upgrade_type = security/' /etc/dnf/automatic.conf
$ sudo systemctl enable --now dnf-automatic-install.timer
$ systemctl list-timers 'dnf-automatic*'
NEXT                        LEFT     LAST PASSED UNIT                        ACTIVATES
Sat 2026-10-10 06:02:08 UTC 22h left -    -      dnf-automatic-install.timer dnf-automatic-install.service

$ journalctl -u dnf-automatic-install.service   # excerpt, different container from the simulation
srv dnf-automatic[100]: Install   1 Package
srv dnf-automatic[100]: Upgrade  14 Packages
srv dnf-automatic[100]: Updates completed at Fri Oct  9 07:22:29 2026
srv systemd[1]: Finished dnf automatic install updates.

Two settings worth knowing. emit_via = stdio (as shipped) only writes the report to the systemd journal: to get an email, switch to emit_via = email and fill in the [email] section, which requires a reachable SMTP server. On versions 9 and 10, reboot accepts never, when-changed or when-needed: by default (the reboot_command setting) it runs shutdown -r +5, five minutes after the updates, with no further confirmation. On version 8, dnf-automatic 4.7 has no such option and silently ignores it.

Do you need to reboot after security updates?

needs-restarting -r compares the install time of critical packages (kernel, glibc, systemd…) with the boot time:

$ sudo dnf install yum-utils        # provides needs-restarting
$ needs-restarting -r; echo "exit code: $?"
No core libraries or services have been updated since boot-up.
Reboot should not be necessary.
exit code: 0

Exit code 1 means a reboot is recommended. The details, and the Debian and SUSE equivalents, are in how to check if a Linux server needs a reboot. For a mixed fleet, see also security updates with apt and security patches with zypper.

Doing this across a fleet (disclosure: I build Kyvian)

The Kyvian agent relies on the same advisories: it reads dnf check-update for the inventory and dnf updateinfo list security to flag security fixes, every 6 hours or on demand. The "Patch security" button runs dnf makecache then dnf update --security -y, after a confirmation that lists the steps and lets you copy the exact command. Reboot detection uses needs-restarting -r, so the same condition applies: yum-utils must be installed.

No hidden automation: nothing is applied without an action from you, or a maintenance window you scheduled (a reboot, a shutdown, or a command of your choice). The agent connects out over HTTPS, with no SSH port open. Details on RHEL and AlmaLinux patch management and Linux patch management. The Discovery plan covers 5 VMs for free, with no time limit and no credit card: try Kyvian.

Originally published on kyvian.io.

DEV Community: Frank Durieux