How to apply only security updates on AlmaLinux, Rocky Linux and RHEL with dnf

Unlike apt, dnf can tell security fixes apart natively: each distribution publishes advisories in its repositories (ALSA for AlmaLinux, RLSA for Rocky, RHSA for Red Hat) with a severity and a list of CVEs. Here is how to list them, apply only those or only the most severe, automate them with dnf-automatic and check whether a reboot is needed. Real output from AlmaLinux 9.8.

The short answer

These commands behave the same on AlmaLinux and Rocky Linux 8, 9 and 10 (dnf 4.7 to 4.20). RHEL ships the same dnf versions. One exception, covered below: dnf-automatic's reboot option does not exist on version 8.

How do you list pending security updates?

Start with the summary, which counts advisories by severity:

$ dnf updateinfo Updates Information Summary: available 12 Security notice(s) 7 Important Security notice(s) 5 Moderate Security notice(s) 

dnf check-update --security lists the packages involved. Its exit code is 100 when updates are available, 0 when there are none and 1 on error, which is handy in a monitoring check.

$ dnf check-update --security coreutils-single.x86_64 8.32-41.el9_8.1 baseos curl-minimal.x86_64 7.76.1-40.el9_8.7 baseos expat.x86_64 2.5.0-6.el9_8.5 baseos (…) openssl.x86_64 1:3.5.8-1.el9_8 baseos openssl-libs.x86_64 1:3.5.8-1.el9_8 baseos pam.x86_64 1.5.1-28.el9_8.1 baseos vim-minimal.x86_64 2:8.2.2637-26.el9_8.23 baseos $ echo $? 100 

dnf updateinfo list security (or list --security) adds the advisory ID and severity for each package. On this server, 14 security lines out of 18 pending updates (excerpt):

$ dnf updateinfo list security ALSA-2026:66403 Moderate/Sec. coreutils-single-8.32-41.el9_8.1.x86_64 ALSA-2026:69126 Important/Sec. curl-minimal-7.76.1-40.el9_8.7.x86_64 ALSA-2026:72663 Important/Sec. expat-2.5.0-6.el9_8.5.x86_64 ALSA-2026:73512 Moderate/Sec. gawk-5.1.0-6.el9_8.1.x86_64 ALSA-2026:67165 Important/Sec. openssl-1:3.5.8-1.el9_8.x86_64 ALSA-2026:67165 Important/Sec. openssl-libs-1:3.5.8-1.el9_8.x86_64 ALSA-2026:64815 Moderate/Sec. pam-1.5.1-28.el9_8.1.x86_64 (…) 

# Rocky Linux 9: same commands, RLSA advisories RLSA-2025:23343 Moderate/Sec. binutils-2.35.2-67.el9_7.1.x86_64 RLSA-2025:0925 Moderate/Sec. bzip2-libs-1.0.8-10.el9_5.x86_64 

To filter by severity: dnf updateinfo list --sec-severity=Important. The levels are Critical, Important, Moderate and Low. To also show each advisory's CVEs: dnf updateinfo list --security --with-cve.

How do you read an advisory?

$ dnf updateinfo info ALSA-2026:67165 =============================================================================== Important: openssl security, bug fix, and enhancement update =============================================================================== Update ID: ALSA-2026:67165 Type: security Updated: 2026-09-15 08:35:12 CVEs: CVE-2026-14456 : CVE-2026-14457 (…) Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, (…) : Security Fix(es): : * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) 

Each advisory gives its severity, the CVEs it fixes and one line per vulnerability: enough to judge how urgent it is, or to answer "is this server patched for that CVE?".

How do you simulate, then apply only security updates?

--assumeno resolves the transaction, prints it and answers "no" to the prompt:

$ sudo dnf upgrade --security --assumeno Upgrading: coreutils-single x86_64 8.32-41.el9_8.1 baseos 599 k curl-minimal x86_64 7.76.1-40.el9_8.7 baseos 127 k (…) openssl-fips-provider x86_64 1:3.5.8-1.el9_8 baseos 813 k openssl-libs x86_64 1:3.5.8-1.el9_8 baseos 2.3 M pam x86_64 1.5.1-28.el9_8.1 baseos 543 k vim-minimal x86_64 2:8.2.2637-26.el9_8.23 baseos 675 k Installing weak dependencies: gawk-all-langpacks x86_64 5.1.0-6.el9_8.1 appstream 206 k Transaction Summary ================================================================================ Install 1 Package Upgrade 13 Packages Total download size: 12 M Operation aborted. 

Note the "Installing weak dependencies" line: even limited to security, an update can install a package that wasn't there before (here a weak dependency of gawk). To prevent it: --setopt=install_weak_deps=False. Drop --assumeno to apply. Afterwards, only updates without a security advisory are left:

$ sudo dnf -y upgrade --security (…) $ dnf check-update gnutls.x86_64 3.8.10-9.el9_8 baseos systemd.x86_64 252-67.el9_8.6.alma.1 baseos systemd-libs.x86_64 252-67.el9_8.6.alma.1 baseos (…) 

Can you target a severity, an advisory or a CVE?

# Only "Important" advisories (9 packages instead of 13 here) sudo dnf upgrade --sec-severity=Important # One specific advisory (openssl, openssl-libs, openssl-fips-provider) sudo dnf upgrade --advisory=ALSA-2026:67165 # Packages that fix a given CVE sudo dnf upgrade --cve=CVE-2026-14456 # The nearest fixed version rather than the latest one sudo dnf upgrade-minimal --security 

All four work with --assumeno so you can check before applying. --advisory picks exactly the advisory's packages (here, the three OpenSSL packages). upgrade-minimal --security produces the same transaction as upgrade --security when the repository only offers one fixed version per package.

How do you automate it with dnf-automatic?

dnf-automatic reads /etc/dnf/automatic.conf. The setting that matters is upgrade_type:

# /etc/dnf/automatic.conf, [commands] section (excerpt, as shipped on AlmaLinux 9) # What kind of upgrade to perform: # default = all available upgrades # security = only the security upgrades upgrade_type = security # shipped as "default" random_sleep = 0 download_updates = yes apply_updates = no reboot = never 

The package ships four systemd timers. dnf-automatic-install.timer downloads and installs regardless of apply_updates; dnf-automatic.timer follows the configuration file; -download and -notifyonly only download or notify. On AlmaLinux 9:

$ sudo dnf install dnf-automatic $ sudo sed -i 's/^upgrade_type = default/upgrade_type = security/' /etc/dnf/automatic.conf $ sudo systemctl enable --now dnf-automatic-install.timer $ systemctl list-timers 'dnf-automatic*' NEXT LEFT LAST PASSED UNIT ACTIVATES Sat 2026-10-10 06:02:08 UTC 22h left - - dnf-automatic-install.timer dnf-automatic-install.service 

$ journalctl -u dnf-automatic-install.service # excerpt, different container from the simulation srv dnf-automatic[100]: Install 1 Package srv dnf-automatic[100]: Upgrade 14 Packages srv dnf-automatic[100]: Updates completed at Fri Oct 9 07:22:29 2026 srv systemd[1]: Finished dnf automatic install updates. 

Two settings worth knowing. emit_via = stdio (as shipped) only writes the report to the systemd journal: to get an email, switch to emit_via = email and fill in the [email] section, which requires a reachable SMTP server. On versions 9 and 10, reboot accepts never, when-changed or when-needed: by default (the reboot_command setting) it runs shutdown -r +5, five minutes after the updates, with no further confirmation. On version 8, dnf-automatic 4.7 has no such option and silently ignores it.

Do you need to reboot after security updates?

needs-restarting -r compares the install time of critical packages (kernel, glibc, systemd…) with the boot time:

$ sudo dnf install yum-utils # provides needs-restarting $ needs-restarting -r; echo "exit code: $?" No core libraries or services have been updated since boot-up. Reboot should not be necessary. exit code: 0 

Exit code 1 means a reboot is recommended. The details, and the Debian and SUSE equivalents, are in how to check if a Linux server needs a reboot. For a mixed fleet, see also security updates with apt and security patches with zypper.

Doing this across a fleet (disclosure: I build Kyvian)

The Kyvian agent relies on the same advisories: it reads dnf check-update for the inventory and dnf updateinfo list security to flag security fixes, every 6 hours or on demand. The "Patch security" button runs dnf makecache then dnf update --security -y, after a confirmation that lists the steps and lets you copy the exact command. Reboot detection uses needs-restarting -r, so the same condition applies: yum-utils must be installed.

No hidden automation: nothing is applied without an action from you, or a maintenance window you scheduled (a reboot, a shutdown, or a command of your choice). The agent connects out over HTTPS, with no SSH port open. Details on RHEL and AlmaLinux patch management and Linux patch management. The Discovery plan covers 5 VMs for free, with no time limit and no credit card: try Kyvian.

Originally published on kyvian.io.