JM Field — Linux VM Patch Audit

2026-07-01 5 Proxmox nodes (PVE 9.1) 18 Linux systems

⚠ Critical — Patch Immediately

Summary cluster-wide Linux only — Windows VMs excluded

Pending Patches
555
across 14 systems
Security Patches
151
-security pocket / updateinfo
High-Risk Hits
71
watchlist pkgs upgradable
Kernel Pending
10
VMs awaiting reboot
EOL Systems
0
none
Heavy Backlogs (≥150)
1
VM 142
Needs Reboot
8
running != installed kernel
Recently Patched
1
≤10 pending

Ubuntu / Debian — Patch Backlog red rows = kernel-pending or high-risk hits

VMIDHostnameNodeOS Upgradable Sec High-Risk PkgsFlagsTier
142MySQL-Dev-2JMFPMX02Ubuntu 24.04 LTS197—apt-utils apt linux-generic linux-headers-generic +2KERNELCritical
123API-Server-3.244JMFPMX01Ubuntu 24.04.4 LTS531linux-generic linux-headers-generic linux-image-genericKERNEL REBOOTHigh
151jmfweb01JMFPMX05Ubuntu 24.04.4 LTS313linux-headers-generic linux-headers-virtual linux-image-virtualKERNEL REBOOTMedium
141EnhancePanel-3.212JMFPMX04Ubuntu 24.04.4 LTS25—linux-generic linux-headers-generic linux-image-extra-virtual linux-image-genericKERNELMedium
9241aivqueue3 (external 3.241)externalUbuntu 24.04.1 LTS21—linux-generic linux-headers-generic linux-image-genericKERNEL REBOOTMedium
132aivtpcserver-3.217JMFPMX04Ubuntu 24.04.4 LTS203linux-generic linux-headers-generic linux-image-genericKERNEL REBOOTMedium
139callcenterJMFPMX03Ubuntu 24.04.4 LTS193linux-generic linux-headers-generic linux-image-genericKERNEL REBOOTMedium
120MySQL-Dev-Server-3.210JMFPMX02Ubuntu 24.04.4 LTS17—linux-generic linux-headers-generic linux-image-genericKERNEL REBOOTMedium
122aivqueue-3.216JMFPMX01Ubuntu 22.04.5 LTS15——REBOOTMedium
137Enhance-Backup-ServerJMFPMX03Ubuntu 24.04.4 LTS143linux-generic linux-headers-generic linux-image-extra-virtual linux-image-genericKERNELMedium
145FreePBX-v17JMFPMX03Debian GNU/Linux 12 (bookworm)1212——Medium
130MariaDB-3.230JMFPMX05Ubuntu 22.04.5 LTS11——REBOOTMedium

RHEL Family scanned via SSH-direct (guest-exec blacklisted)

VMIDHostnameNodeOS Sec High-Risk PkgsFlagsStatus
121aivscripttesting3.202JMFPMX02AlmaLinux 8.10 (Cerulean Leopard)126glibc glibc-all-langpacks glibc-common glibc-devel +35KERNEL119 pending
126aivscript-3.240JMFPMX04CentOS Linux 7 (Core)———1 pending
114FTP-ProductionJMFPMX02AlmaLinux 10.2 (Lavender Lion)———Unreachable

Watchlist — Why These Packages Matter

0-Day / Active Exploits (May 2026)

  • Linux Kernel CVE-2026-31431 Dirty Frag — local user → root. Mitigation if not patched: disable esp4, esp6, rxrpc modules.
  • Container Runtimes — Copy Fail — container escape vector. Affects containerd, docker.io/docker-ce, runc, cri-o after kernel CVEs.

Privilege / Identity Boundary

  • systemd — init + service manager; flaws = full system compromise.
  • OpenSSH (sshd) — remote access; patch every minor release.
  • OpenSSL / libssl — TLS/crypto across the stack.
  • polkit / dbus — system-wide privilege handlers + IPC security.
  • glibc (libc6) — used by ~every binary; quiet but devastating.

Supply Chain

  • Package managers themselves — apt, dnf, yum, dpkg, rpm. Patched before any other update.

Verify After Patching

  • Debian/Ubuntu: cat /var/run/reboot-required
  • RHEL/Fedora: dnf needs-restarting -r
  • For 0-day kernel CVEs, prefer live-patching: Canonical Livepatch / KernelCare / Oracle Ksplice to avoid downtime.

Unreachable no patch count this run

  • VMID 114 (FTP-Production, JMFPMX02): ssh-direct 192.168.3.213:2222
  • VMID 134 (pulse, JMFPMX04): pvesh-lxc-exec
  • VMID 150 (uptime-kuma, JMFPMX03): pvesh-lxc-exec

Methodology

  • Cluster-wide enumeration via pvesh get /cluster/resources --type vm
  • OS detection via QEMU guest-agent get-osinfo (Windows VMs filtered out)
  • Patch counts for Debian/Ubuntu via guest-exec apt list --upgradable / pct exec for LXC
  • RHEL family scanned via direct SSH (guest-exec disabled by default policy)
  • 14 of 18 Linux systems returned a numeric patch count this run
  • Generated automatically by /opt/jmfield-patch-audit/scripts/run-monthly.sh on JMFPMX04 monthly cron