Checklist: Post-patching validation

Run this checklist after every patch wave, before the next wave starts. The readiness gates you closed before the change live in linux-checklist-pre-patching; this one proves the change actually landed.

Pending reboot and the running kernel

Two separate checks. The first asks whether anything installed requested a reboot. The second asks whether the reboot happened and took effect.

Read-only / Saferunning vs newest installed kernel— The running kernel is older than the newest installed kernel, so the host is running unpatched code even though the package manager reports the fix as installed. This host is not remediated until it reboots. On Debian and Ubuntu /var/run/reboot-required is created by the package hooks; on RHEL, needs-restarting -r exits 1 when a reboot is required.

$ uname -r; ls -1 /boot/vmlinuz-* | sed 's|.*vmlinuz-||' | sort -V | tail -1

6.8.0-45-generic
6.8.0-52-generic

Processes still mapping replaced libraries

A library upgrade replaces the file on disk. Processes that already mapped the old inode keep using it until they restart. needrestart (installed by default on Ubuntu) and needs-restarting -s (RHEL, from dnf-utils) list exactly which services are affected.

Read-only / Safeneedrestart -b— Batch mode prints machine-readable output and restarts nothing. KSTA 3 means the running kernel is obsolete. Each NEEDRESTART-SVC line is a unit still mapping a replaced library. Restart those units in a controlled order, or reboot; the wave is not complete while the list is non-empty.

$ sudo needrestart -b

NEEDRESTART-VER: 3.11
NEEDRESTART-KCUR: 6.8.0-45-generic
NEEDRESTART-KEXP: 6.8.0-52-generic
NEEDRESTART-KSTA: 3
NEEDRESTART-SVC: nginx.service
NEEDRESTART-SVC: postgresql@16-main.service

Unmerged configuration files

An upgrade that cannot safely merge a configuration file leaves the new version beside the old one. The service keeps running the old configuration, and the security fix that lived in the new default is not applied.

There are two directions of failure, and the suffix tells you which one you have. Sweep for all of them, on both families:

Read-only / Safeunmerged conffiles— Two different failures in one listing. sshd_config.dpkg-dist means your file was kept and the vendor's new default was parked beside it, so the security fix in that default is not live. auditd.conf.rpmsave is the opposite: the vendor file was installed and your version was moved aside, so local hardening has been silently reverted. Diff each pair, merge deliberately, then reload the service.

$ find /etc \( -name '*.dpkg-dist' -o -name '*.dpkg-new' -o -name '*.dpkg-old' -o -name '*.ucf-dist' -o -name '*.rpmnew' -o -name '*.rpmsave' \) -print 2>/dev/null

/etc/ssh/sshd_config.dpkg-dist
/etc/audit/auditd.conf.rpmsave

Read the suffix before you decide what to do:

.dpkg-dist, .dpkg-new, .rpmnew, .ucf-dist: your file is live, the vendor version is parked. The vendor change was not adopted.
.dpkg-old, .rpmsave: the vendor file is live, your version is parked. Your local change was reverted.

Neither state raises an alert on its own, and a scanner that reads package versions calls the host patched in both cases. The sweep is the only thing that catches them, which is why the checklist item is critical rather than advisory. linux-package-management-overview covers the dpkg conffile policy flags that produce each outcome.

Sign-off

Operator: _________________ Date: ___________
Reviewer: ________________ Date: ___________