Reboot after updates that require it, or use Livepatch

Description

Some updates only take effect after a reboot: the kernel, and libraries loaded by every process such as the C library, OpenSSL or systemd. When a package asks for it, update-notifier-common creates /var/run/reboot-required and lists the packages concerned in /var/run/reboot-required.pkgs. Both files disappear at the next boot (/var/run is a tmpfs).

Canonical Livepatch, part of Ubuntu Pro, applies the fixes for high and critical kernel vulnerabilities to the running kernel without a reboot.

The control fails when /var/run/reboot-required is older than {{ max_days }} days, unless every package that asked for the reboot is a kernel package (linux-*) and Livepatch is running and has applied its patches.

The control does not reboot the system: there is no automated fix. Long-running processes can also keep old libraries mapped without any reboot-required file; needrestart (installed by default on 22.04 and later servers) restarts the services concerned after updates.

Rationale

An updated package on disk does not protect the system while the old kernel or library is still in memory: a scanner reading package versions reports the system as fixed while the vulnerability can still be exploited. Systems that are never rebooted are among the most frequent audit findings. A bounded delay leaves time to plan the reboot in a maintenance window.

Impact

Rebooting interrupts the services of the system: plan a regular maintenance window, or use Unattended-Upgrade::Automatic-Reboot with Automatic-Reboot-Time on systems that can reboot on their own. Livepatch needs an Ubuntu Pro subscription and only covers the kernel.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. ls -l --time-style=+%F /var/run/reboot-required shows no file, or a date at most {{ max_days }} days ago.
2. Otherwise, cat /var/run/reboot-required.pkgs lists only linux-* packages and canonical-livepatch status shows Livepatch running with its patches applied.

Automated: every check must pass. Scanners report each check by its id.

reboot-required

Age of /var/run/reboot-required, packages that asked for the reboot, and Livepatch state.

script: |
  f=/var/run/reboot-required
  [ -e "$f" ] || { echo "no reboot required"; exit 0; }
  age=$(( ($(date +%s) - $(stat -c %Y "$f")) / 86400 ))
  pkgs=$(sort -u "$f.pkgs" 2>/dev/null | tr '\n' ' ')
  echo "reboot required for $age days (limit $CB_MAX_DAYS) by: ${pkgs:-unknown packages}"
  [ "$age" -le "$CB_MAX_DAYS" ] && exit 0
  if [ -n "$pkgs" ] && [ -z "$(sort -u "$f.pkgs" | grep -v '^linux-')" ]; then
    lp=/snap/bin/canonical-livepatch
    if [ -x "$lp" ] && "$lp" status --format=json 2>/dev/null | grep -Eiq '"patchState": ?"(applied|nothing-to-apply)"'; then
      echo "kernel updates only, covered by Livepatch"
      exit 0
    fi
    echo "kernel updates only, Livepatch not running or not applied"
  fi
  exit 1

Remediation

Reboot the system during a maintenance window (systemctl reboot), then check that /var/run/reboot-required is gone. To keep up without a human:

• schedule the reboot with unattended-upgrades on systems that can reboot unattended, in /etc/apt/apt.conf.d/52unattended-upgrades-local: Unattended-Upgrade::Automatic-Reboot "true"; and Unattended-Upgrade::Automatic-Reboot-Time "03:00";;
• on systems attached to Ubuntu Pro, enable Livepatch (pro enable livepatch) to defer kernel reboots, and still reboot for the other packages.

References

• Ubuntu Server documentation - Automatic updates Canonical, vendor-doc, accessed 2026-10-19
• unattended-upgrade(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Canonical Livepatch Canonical, vendor-doc, accessed 2026-10-19
• Canonical Livepatch documentation Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-PKG-007 Install security updates automatically
• related CB-UBU-PKG-008 Leave no security update pending

People and lifecycle