On Red Hat Enterprise Linux-based systems (AlmaLinux, Rocky Linux, CloudLinux), the package manager can be configured to install only security patches, whilst skipping updates that fix bugs or introduce new features. This is useful if you wish to patch security vulnerabilities on a production server with as few changes as possible.

In version 8 and later, the package manager is dnf; the yum command is an alias pointing to dnf-re, so the old commands still work. Information on security tickets is published within the package repository, so there is no need to install a separate add-on.

List of available security updates

A list of all available tickets (security, bug fixes and development):

dnf updateinfo list

Only available security updates:

dnf updateinfo list --security

Security updates summarised by severity (Critical, Important, Moderate, Low):

dnf updateinfo summary

On a test machine installed from an AlmaLinux 10 image from a couple of weeks ago:

Updates Information Summary: available
    14 Security notice(s)
         1 Critical Security notice(s)
        10 Important Security notice(s)
         3 Moderate Security notice(s)

The command dnf updateinfo list --security displays the ticket ID, severity and package on a line-by-line basis, for example: ALSA-2026:88455 Critical/Sec. ca-certificates-… (on AlmaLinux, IDs are prefixed with ALSA-, whilst on Rocky Linux they are prefixed with RLSA-).

A detailed description of each ticket, together with the relevant CVE identifiers:

dnf updateinfo info --security

List of security updates already installed:

dnf updateinfo list --security --installed

Installing security updates

Installing all available security updates:

sudo dnf upgrade --security

This installs the latest version of every package for which there is at least one security ticket. If the latest version also contains other fixes, these will be applied as well, and due to dependencies, the system version may be incremented slightly (for example, from 9.5 to 9.6).

If you only wish to install the smallest version containing the security patch, use this:

sudo dnf upgrade-minimal --security

Fixing a specific vulnerability based on the CVE identifier or the ticket ID:

sudo dnf upgrade --cve CVE-2026-12345
sudo dnf upgrade --advisory ALSA-2026:1234

Only fixes classified as ‘critical’ and ‘important’:

sudo dnf upgrade --security --sec-severity=Critical --sec-severity=Important

After a kernel update, the fix only takes effect after a reboot. The dnf needs-restarting -r command (from the dnf-plugins-core package, which is installed by default) indicates whether a reboot is required. In the test, the command sudo dnf upgrade-minimal --security --sec-severity=Critical --sec-severity=Important updated 19 packages, including glibc-t and the kernel, after which needs-restarting -r` requested a reboot.

Automatic security updates

The dnf-automatic package handles the automatic, daily installation of security updates; the steps for setting this up are described in our article on system updates. In the configuration, the line upgrade_type = security restricts the installation to security patches.

On older systems

CentOS 7 and CloudLinux 7 no longer receive regular updates. The same commands work on these systems using yum (yum updateinfo list security, yum update --security), but for security reasons, it is advisable to upgrade the server to a newer version or migrate it.