JM Field — Linux VM Patch Audit

2026-09-01 5 Proxmox nodes (PVE 9.1) 18 Linux systems

⚠ Critical — Patch Immediately

Summary cluster-wide Linux only — Windows VMs excluded

Pending Patches
282
across 16 systems — mostly routine SRU
Security Patches
92
installable security only (apt-check / dnf --security)
High-Risk Hits
8
watchlist pkgs upgradable
Kernel Pending
1
VMs awaiting reboot
EOL Systems
0
none
Heavy Backlogs (≥150)
0
none
Needs Reboot
1
running != installed kernel
Recently Patched
5
≤10 pending

Ubuntu / Debian — Patch Backlog red rows = kernel-pending or high-risk hits

VMIDHostnameNodeOS Upgradable Sec High-Risk PkgsFlagsTier
141EnhancePanel-3.212JMFPMX04Ubuntu 24.04.4 LTS6127——High
151jmfweb01JMFPMX05Ubuntu 24.04.4 LTS3824——Medium
137Enhance-Backup-ServerJMFPMX03Ubuntu 24.04.4 LTS2613——Medium
123API-Server-3.244JMFPMX01Ubuntu 24.04.4 LTS25———Medium
9241aivqueue3 (external 3.241)externalUbuntu 24.04.1 LTS191—REBOOTMedium
120MySQL-Dev-Server-3.210JMFPMX02Ubuntu 24.04.4 LTS16———Medium
142MySQL-Dev-2JMFPMX02Ubuntu 24.04.4 LTS15———Medium
132aivtpcserver-3.217JMFPMX04Ubuntu 24.04.4 LTS14———Medium
139callcenterJMFPMX03Ubuntu 24.04.4 LTS13———Medium
122aivqueue-3.216JMFPMX01Ubuntu 22.04.5 LTS12———Medium
130MariaDB-3.230JMFPMX05Ubuntu 22.04.5 LTS7———Low
145FreePBX-v17JMFPMX03Debian GNU/Linux 12 (bookworm)33——Low
150uptime-kuma LXCJMFPMX03Debian (LXC)21——Low
134pulse LXCJMFPMX04Debian (LXC)11——Low

RHEL Family scanned via SSH-direct (guest-exec blacklisted)

VMIDHostnameNodeOS Sec High-Risk PkgsFlagsStatus
121aivscripttesting3.202JMFPMX02AlmaLinux 8.10 (Cerulean Leopard)22kernel kernel-core kernel-headers kernel-modules +4KERNEL29 pending
126aivscript-3.240JMFPMX04CentOS Linux 7 (Core)———1 pending
114FTP-ProductionJMFPMX02AlmaLinux 10.2 (Lavender Lion)———Unreachable

Watchlist — Why These Packages Matter

0-Day / Active Exploits (May 2026)

  • Linux Kernel CVE-2026-31431 Dirty Frag — local user → root. Mitigation if not patched: disable esp4, esp6, rxrpc modules.
  • Container Runtimes — Copy Fail — container escape vector. Affects containerd, docker.io/docker-ce, runc, cri-o after kernel CVEs.

Privilege / Identity Boundary

  • systemd — init + service manager; flaws = full system compromise.
  • OpenSSH (sshd) — remote access; patch every minor release.
  • OpenSSL / libssl — TLS/crypto across the stack.
  • polkit / dbus — system-wide privilege handlers + IPC security.
  • glibc (libc6) — used by ~every binary; quiet but devastating.

Supply Chain

  • Package managers themselves — apt, dnf, yum, dpkg, rpm. Patched before any other update.

Verify After Patching

  • Debian/Ubuntu: cat /var/run/reboot-required
  • RHEL/Fedora: dnf needs-restarting -r
  • For 0-day kernel CVEs, prefer live-patching: Canonical Livepatch / KernelCare / Oracle Ksplice to avoid downtime.

Unreachable no patch count this run

  • VMID 114 (FTP-Production, JMFPMX02): ssh-direct 192.168.3.213:2222

Methodology

  • Cluster-wide enumeration via pvesh get /cluster/resources --type vm
  • OS detection via QEMU guest-agent get-osinfo (Windows VMs filtered out)
  • Patch counts for Debian/Ubuntu via guest-exec apt list --upgradable / pct exec for LXC
  • RHEL family scanned via direct SSH (guest-exec disabled by default policy)
  • 16 of 18 Linux systems returned a numeric patch count this run
  • Generated automatically by /opt/jmfield-patch-audit/scripts/run-monthly.sh on JMFPMX04 monthly cron