Unlike apt, dnf can tell security fixes apart natively: each distribution publishes advisories in its repositories (ALSA for AlmaLinux, RLSA for Rocky, RHSA for Red Hat) with a severity and a list of CVEs. Here is how to list them, apply only those or only the most severe, automate them with dnf-automatic and check whether a reboot is needed. Real output from AlmaLinux 9.8.
The short answer
| Goal | Command |
|---|---|
| How many security advisories are pending? | dnf updateinfo |
| Which packages, which advisories? | dnf updateinfo list security |
| Simulate | dnf upgrade --security --assumeno |
| Apply | dnf upgrade --security |
| Only the most severe |
dnf upgrade --sec-severity=Critical (or Important) |
| Automate |
dnf-automatic with upgrade_type = security
|
| Reboot needed? | needs-restarting -r |
These commands behave the same on AlmaLinux and Rocky Linux 8, 9 and 10 (dnf 4.7 to 4.20). RHEL ships the same dnf versions. One exception, covered below: dnf-automatic's reboot option does not exist on version 8.
How do you list pending security updates?
Start with the summary, which counts advisories by severity:
$ dnf updateinfo
Updates Information Summary: available
12 Security notice(s)
7 Important Security notice(s)
5 Moderate Security notice(s)
dnf check-update --security lists the packages involved. Its exit code is 100 when updates are available, 0 when there are none and 1 on error, which is handy in a monitoring check.
$ dnf check-update --security
coreutils-single.x86_64 8.32-41.el9_8.1 baseos
curl-minimal.x86_64 7.76.1-40.el9_8.7 baseos
expat.x86_64 2.5.0-6.el9_8.5 baseos
(…)
openssl.x86_64 1:3.5.8-1.el9_8 baseos
openssl-libs.x86_64 1:3.5.8-1.el9_8 baseos
pam.x86_64 1.5.1-28.el9_8.1 baseos
vim-minimal.x86_64 2:8.2.2637-26.el9_8.23 baseos
$ echo $?
100
dnf updateinfo list security (or list --security) adds the advisory ID and severity for each package. On this server, 14 security lines out of 18 pending updates (excerpt):
$ dnf updateinfo list security
ALSA-2026:66403 Moderate/Sec. coreutils-single-8.32-41.el9_8.1.x86_64
ALSA-2026:69126 Important/Sec. curl-minimal-7.76.1-40.el9_8.7.x86_64
ALSA-2026:72663 Important/Sec. expat-2.5.0-6.el9_8.5.x86_64
ALSA-2026:73512 Moderate/Sec. gawk-5.1.0-6.el9_8.1.x86_64
ALSA-2026:67165 Important/Sec. openssl-1:3.5.8-1.el9_8.x86_64
ALSA-2026:67165 Important/Sec. openssl-libs-1:3.5.8-1.el9_8.x86_64
ALSA-2026:64815 Moderate/Sec. pam-1.5.1-28.el9_8.1.x86_64
(…)
# Rocky Linux 9: same commands, RLSA advisories
RLSA-2025:23343 Moderate/Sec. binutils-2.35.2-67.el9_7.1.x86_64
RLSA-2025:0925 Moderate/Sec. bzip2-libs-1.0.8-10.el9_5.x86_64
To filter by severity: dnf updateinfo list --sec-severity=Important. The levels are Critical, Important, Moderate and Low. To also show each advisory's CVEs: dnf updateinfo list --security --with-cve.
How do you read an advisory?
$ dnf updateinfo info ALSA-2026:67165
===============================================================================
Important: openssl security, bug fix, and enhancement update
===============================================================================
Update ID: ALSA-2026:67165
Type: security
Updated: 2026-09-15 08:35:12
CVEs: CVE-2026-14456
: CVE-2026-14457
(…)
Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, (…)
: Security Fix(es):
: * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
Each advisory gives its severity, the CVEs it fixes and one line per vulnerability: enough to judge how urgent it is, or to answer "is this server patched for that CVE?".
How do you simulate, then apply only security updates?
--assumeno resolves the transaction, prints it and answers "no" to the prompt:
$ sudo dnf upgrade --security --assumeno
Upgrading:
coreutils-single x86_64 8.32-41.el9_8.1 baseos 599 k
curl-minimal x86_64 7.76.1-40.el9_8.7 baseos 127 k
(…)
openssl-fips-provider x86_64 1:3.5.8-1.el9_8 baseos 813 k
openssl-libs x86_64 1:3.5.8-1.el9_8 baseos 2.3 M
pam x86_64 1.5.1-28.el9_8.1 baseos 543 k
vim-minimal x86_64 2:8.2.2637-26.el9_8.23 baseos 675 k
Installing weak dependencies:
gawk-all-langpacks x86_64 5.1.0-6.el9_8.1 appstream 206 k
Transaction Summary
================================================================================
Install 1 Package
Upgrade 13 Packages
Total download size: 12 M
Operation aborted.
Note the "Installing weak dependencies" line: even limited to security, an update can install a package that wasn't there before (here a weak dependency of gawk). To prevent it: --setopt=install_weak_deps=False. Drop --assumeno to apply. Afterwards, only updates without a security advisory are left:
$ sudo dnf -y upgrade --security
(…)
$ dnf check-update
gnutls.x86_64 3.8.10-9.el9_8 baseos
systemd.x86_64 252-67.el9_8.6.alma.1 baseos
systemd-libs.x86_64 252-67.el9_8.6.alma.1 baseos
(…)
Can you target a severity, an advisory or a CVE?
# Only "Important" advisories (9 packages instead of 13 here)
sudo dnf upgrade --sec-severity=Important
# One specific advisory (openssl, openssl-libs, openssl-fips-provider)
sudo dnf upgrade --advisory=ALSA-2026:67165
# Packages that fix a given CVE
sudo dnf upgrade --cve=CVE-2026-14456
# The nearest fixed version rather than the latest one
sudo dnf upgrade-minimal --security
All four work with --assumeno so you can check before applying. --advisory picks exactly the advisory's packages (here, the three OpenSSL packages). upgrade-minimal --security produces the same transaction as upgrade --security when the repository only offers one fixed version per package.
How do you automate it with dnf-automatic?
dnf-automatic reads /etc/dnf/automatic.conf. The setting that matters is upgrade_type:
# /etc/dnf/automatic.conf, [commands] section (excerpt, as shipped on AlmaLinux 9)
# What kind of upgrade to perform:
# default = all available upgrades
# security = only the security upgrades
upgrade_type = security # shipped as "default"
random_sleep = 0
download_updates = yes
apply_updates = no
reboot = never
The package ships four systemd timers. dnf-automatic-install.timer downloads and installs regardless of apply_updates; dnf-automatic.timer follows the configuration file; -download and -notifyonly only download or notify. On AlmaLinux 9:
$ sudo dnf install dnf-automatic
$ sudo sed -i 's/^upgrade_type = default/upgrade_type = security/' /etc/dnf/automatic.conf
$ sudo systemctl enable --now dnf-automatic-install.timer
$ systemctl list-timers 'dnf-automatic*'
NEXT LEFT LAST PASSED UNIT ACTIVATES
Sat 2026-10-10 06:02:08 UTC 22h left - - dnf-automatic-install.timer dnf-automatic-install.service
$ journalctl -u dnf-automatic-install.service # excerpt, different container from the simulation
srv dnf-automatic[100]: Install 1 Package
srv dnf-automatic[100]: Upgrade 14 Packages
srv dnf-automatic[100]: Updates completed at Fri Oct 9 07:22:29 2026
srv systemd[1]: Finished dnf automatic install updates.
Two settings worth knowing. emit_via = stdio (as shipped) only writes the report to the systemd journal: to get an email, switch to emit_via = email and fill in the [email] section, which requires a reachable SMTP server. On versions 9 and 10, reboot accepts never, when-changed or when-needed: by default (the reboot_command setting) it runs shutdown -r +5, five minutes after the updates, with no further confirmation. On version 8, dnf-automatic 4.7 has no such option and silently ignores it.
Do you need to reboot after security updates?
needs-restarting -r compares the install time of critical packages (kernel, glibc, systemd…) with the boot time:
$ sudo dnf install yum-utils # provides needs-restarting
$ needs-restarting -r; echo "exit code: $?"
No core libraries or services have been updated since boot-up.
Reboot should not be necessary.
exit code: 0
Exit code 1 means a reboot is recommended. The details, and the Debian and SUSE equivalents, are in how to check if a Linux server needs a reboot. For a mixed fleet, see also security updates with apt and security patches with zypper.
Doing this across a fleet (disclosure: I build Kyvian)
The Kyvian agent relies on the same advisories: it reads dnf check-update for the inventory and dnf updateinfo list security to flag security fixes, every 6 hours or on demand. The "Patch security" button runs dnf makecache then dnf update --security -y, after a confirmation that lists the steps and lets you copy the exact command. Reboot detection uses needs-restarting -r, so the same condition applies: yum-utils must be installed.
No hidden automation: nothing is applied without an action from you, or a maintenance window you scheduled (a reboot, a shutdown, or a command of your choice). The agent connects out over HTTPS, with no SSH port open. Details on RHEL and AlmaLinux patch management and Linux patch management. The Discovery plan covers 5 VMs for free, with no time limit and no credit card: try Kyvian.
Originally published on kyvian.io.
Top comments (0)