JM Field — Linux VM Patch Audit

2026-06-15 5 Proxmox nodes (PVE 9.1) 19 Linux systems

⚠ Critical — Patch Immediately

Summary cluster-wide Linux only — Windows VMs excluded

Pending Patches
570
across 15 systems
Security Patches
216
-security pocket / updateinfo
High-Risk Hits
44
watchlist pkgs upgradable
Kernel Pending
3
VMs awaiting reboot
EOL Systems
0
none
Heavy Backlogs (≥150)
1
VM 142
Needs Reboot
9
running != installed kernel
Recently Patched
6
≤10 pending

Ubuntu / Debian — Patch Backlog red rows = kernel-pending or high-risk hits

VMIDHostnameNodeOS Upgradable Sec High-Risk PkgsFlagsTier
142MySQL-Dev-2JMFPMX02Ubuntu 24.04 LTS1972apt-utils apt systemd-hwe-hwdbREBOOTCritical
137Enhance-Backup-ServerJMFPMX03Ubuntu 24.04.4 LTS11492dpkg linux-generic linux-headers-generic linux-image-extra-virtual +9KERNELHigh
123API-Server-3.244JMFPMX01Ubuntu 24.04.4 LTS3919—REBOOTMedium
141EnhancePanel-3.212JMFPMX04Ubuntu 24.04.4 LTS3318——Medium
151jmfweb01JMFPMX05Ubuntu 24.04.4 LTS23——REBOOTMedium
122aivqueue-3.216JMFPMX01Ubuntu 22.04.5 LTS184—REBOOTMedium
9241aivqueue3 (external 3.241)externalUbuntu 24.04.1 LTS162—REBOOTMedium
120MySQL-Dev-Server-3.210JMFPMX02Ubuntu 24.04.4 LTS112—REBOOTMedium
132aivtpcserver-3.217JMFPMX04Ubuntu 24.04.4 LTS102—REBOOTMedium
139callcenterJMFPMX03Ubuntu 24.04.4 LTS102—REBOOTMedium
130MariaDB-3.230JMFPMX05Ubuntu 22.04.5 LTS9——REBOOTLow
149claude-automationJMFPMX03Ubuntu 24.04.4 LTS44linux-headers-generic linux-headers-virtual linux-image-virtualKERNELLow
145FreePBX-v17JMFPMX03Debian GNU/Linux 12 (bookworm)22——Low

RHEL Family scanned via SSH-direct (guest-exec blacklisted)

VMIDHostnameNodeOS Sec High-Risk PkgsFlagsStatus
121aivscripttesting3.202JMFPMX02AlmaLinux 8.10 (Cerulean Leopard)67glibc glibc-all-langpacks glibc-common glibc-devel +21KERNEL84 pending
126aivscript-3.240JMFPMX04CentOS Linux 7 (Core)———Current
114FTP-ProductionJMFPMX02AlmaLinux 10.1 (Heliotrope Lion)———Unreachable

Watchlist — Why These Packages Matter

0-Day / Active Exploits (May 2026)

  • Linux Kernel CVE-2026-31431 Dirty Frag — local user → root. Mitigation if not patched: disable esp4, esp6, rxrpc modules.
  • Container Runtimes — Copy Fail — container escape vector. Affects containerd, docker.io/docker-ce, runc, cri-o after kernel CVEs.

Privilege / Identity Boundary

  • systemd — init + service manager; flaws = full system compromise.
  • OpenSSH (sshd) — remote access; patch every minor release.
  • OpenSSL / libssl — TLS/crypto across the stack.
  • polkit / dbus — system-wide privilege handlers + IPC security.
  • glibc (libc6) — used by ~every binary; quiet but devastating.

Supply Chain

  • Package managers themselves — apt, dnf, yum, dpkg, rpm. Patched before any other update.

Verify After Patching

  • Debian/Ubuntu: cat /var/run/reboot-required
  • RHEL/Fedora: dnf needs-restarting -r
  • For 0-day kernel CVEs, prefer live-patching: Canonical Livepatch / KernelCare / Oracle Ksplice to avoid downtime.

Unreachable no patch count this run

  • VMID 114 (FTP-Production, JMFPMX02): ssh-direct 192.168.3.213:2222
  • VMID 134 (pulse, JMFPMX04): pvesh-lxc-exec
  • VMID 150 (uptime-kuma, JMFPMX03): pvesh-lxc-exec

Methodology

  • Cluster-wide enumeration via pvesh get /cluster/resources --type vm
  • OS detection via QEMU guest-agent get-osinfo (Windows VMs filtered out)
  • Patch counts for Debian/Ubuntu via guest-exec apt list --upgradable / pct exec for LXC
  • RHEL family scanned via direct SSH (guest-exec disabled by default policy)
  • 15 of 19 Linux systems returned a numeric patch count this run
  • Generated automatically by /opt/jmfield-patch-audit/scripts/run-monthly.sh on JMFPMX04 monthly cron