JM Field — Linux VM Patch Audit

2026-07-15 5 Proxmox nodes (PVE 9.1) 18 Linux systems

⚠ Critical — Patch Immediately

Summary cluster-wide Linux only — Windows VMs excluded

Pending Patches
780
across 14 systems
Security Patches
231
-security pocket / updateinfo
High-Risk Hits
55
watchlist pkgs upgradable
Kernel Pending
2
VMs awaiting reboot
EOL Systems
0
none
Heavy Backlogs (≥150)
2
VM 142, VM 121
Needs Reboot
10
running != installed kernel
Recently Patched
1
≤10 pending

Ubuntu / Debian — Patch Backlog red rows = kernel-pending or high-risk hits

VMIDHostnameNodeOS Upgradable Sec High-Risk PkgsFlagsTier
142MySQL-Dev-2JMFPMX02Ubuntu 24.04 LTS195—apt-utils apt systemd-hwe-hwdb—Critical
145FreePBX-v17JMFPMX03Debian GNU/Linux 12 (bookworm)8929linux-image-amd64KERNELHigh
123API-Server-3.244JMFPMX01Ubuntu 24.04.4 LTS771—REBOOTHigh
141EnhancePanel-3.212JMFPMX04Ubuntu 24.04.4 LTS6013—REBOOTHigh
9241aivqueue3 (external 3.241)externalUbuntu 24.04.1 LTS41——REBOOTMedium
122aivqueue-3.216JMFPMX01Ubuntu 22.04.5 LTS34——REBOOTMedium
139callcenterJMFPMX03Ubuntu 24.04.4 LTS3011—REBOOTMedium
151jmfweb01JMFPMX05Ubuntu 24.04.4 LTS29——REBOOTMedium
120MySQL-Dev-Server-3.210JMFPMX02Ubuntu 24.04.4 LTS20——REBOOTMedium
132aivtpcserver-3.217JMFPMX04Ubuntu 24.04.4 LTS20——REBOOTMedium
130MariaDB-3.230JMFPMX05Ubuntu 22.04.5 LTS14——REBOOTMedium
137Enhance-Backup-ServerJMFPMX03Ubuntu 24.04.4 LTS14——REBOOTMedium

RHEL Family scanned via SSH-direct (guest-exec blacklisted)

VMIDHostnameNodeOS Sec High-Risk PkgsFlagsStatus
121aivscripttesting3.202JMFPMX02AlmaLinux 8.10 (Cerulean Leopard)177glibc glibc-all-langpacks glibc-common glibc-devel +47KERNEL156 pending
126aivscript-3.240JMFPMX04CentOS Linux 7 (Core)———1 pending
114FTP-ProductionJMFPMX02AlmaLinux 10.2 (Lavender Lion)———Unreachable

Watchlist — Why These Packages Matter

0-Day / Active Exploits (May 2026)

  • Linux Kernel CVE-2026-31431 Dirty Frag — local user → root. Mitigation if not patched: disable esp4, esp6, rxrpc modules.
  • Container Runtimes — Copy Fail — container escape vector. Affects containerd, docker.io/docker-ce, runc, cri-o after kernel CVEs.

Privilege / Identity Boundary

  • systemd — init + service manager; flaws = full system compromise.
  • OpenSSH (sshd) — remote access; patch every minor release.
  • OpenSSL / libssl — TLS/crypto across the stack.
  • polkit / dbus — system-wide privilege handlers + IPC security.
  • glibc (libc6) — used by ~every binary; quiet but devastating.

Supply Chain

  • Package managers themselves — apt, dnf, yum, dpkg, rpm. Patched before any other update.

Verify After Patching

  • Debian/Ubuntu: cat /var/run/reboot-required
  • RHEL/Fedora: dnf needs-restarting -r
  • For 0-day kernel CVEs, prefer live-patching: Canonical Livepatch / KernelCare / Oracle Ksplice to avoid downtime.

Unreachable no patch count this run

  • VMID 114 (FTP-Production, JMFPMX02): ssh-direct 192.168.3.213:2222
  • VMID 134 (pulse, JMFPMX04): pvesh-lxc-exec
  • VMID 150 (uptime-kuma, JMFPMX03): pvesh-lxc-exec

Methodology

  • Cluster-wide enumeration via pvesh get /cluster/resources --type vm
  • OS detection via QEMU guest-agent get-osinfo (Windows VMs filtered out)
  • Patch counts for Debian/Ubuntu via guest-exec apt list --upgradable / pct exec for LXC
  • RHEL family scanned via direct SSH (guest-exec disabled by default policy)
  • 14 of 18 Linux systems returned a numeric patch count this run
  • Generated automatically by /opt/jmfield-patch-audit/scripts/run-monthly.sh on JMFPMX04 monthly cron