Patch priority decisions - timing and risk · Linux

Every patch is a trade-off: close a vulnerability vs risk a regression. This lesson is the discipline for making that decision.

The decision factors

Severity (CVSS score).
Exposure (internet, internal, isolated).
Active exploitation (in the wild).
Patch quality (well-tested, risky, experimental).
Service criticality (production revenue, internal tool).
Mitigation availability (workaround exists?).
Time to test (staging cycle, validation).

Decision patterns

Critical CVE + active exploit: emergency change window. Patch within hours, even at risk. Communicate widely.

Critical CVE + no exploit: schedule change within days. Test in staging, apply in production during low-traffic.

High CVE + active exploit: emergency change window. Patch within 24 hours.

High CVE + no exploit: regular maintenance window. Patch within a week.

Medium / Low CVE: regular maintenance. Patch within the release cycle.

Patch with known regression: defer until regression is fixed, unless exploit is active.

Communicate

Every non-routine patch needs communication:

SUBJECT: PATCH 2026-08-09 02:00 UTC - nginx 1.27.2
AFFECTS: web01, web02, web03
REASON: CVE-2024-XXXXX (Critical, CVSS 9.8)
DOWN EXPECTED: &lt;5 minutes per host
ROLLBACK: revert via package manager if smoke test fails
CONTACT: <on-call>

For service-impacting patches:

Notify in advance (24-48 hours when possible).
Document in a change record.
Have rollback ready.
Monitor after deploy.

Test in staging

# In staging
sudo apt upgrade -y
sudo systemctl restart nginx
curl -I https://staging.example.com

For critical services, staging should mirror production: load balancer, backend, database. The more similar the better.

Document exceptions

If a patch is deferred:

EXCEPTION: CVE-2024-XXXXX (Critical)
Affected: app-server-12
Decision: Defer 7 days
Reason: Patch breaks app config X; workaround in progress
Mitigation: WAF rule blocks exploit signature
Approved by: Security Team
Review: weekly until fixed

Exceptions are not “do not patch” - they are “patch later, with risk documented and reviewed”.

Communicate after patching

SUBJECT: APPLIED 2026-08-09 02:00 UTC - nginx 1.27.2
STATUS: All three web hosts patched
VERIFIED: Smoke tests passed; no errors in journal
NEXT: Monitor for 24 hours; close incident if clean

The post-patch communication closes the loop.