A Fix That Landed on Six of Seven Hosts
A repo-mirror fix rolled out fleet-wide, and the next morning’s drift check found the one machine it never reached.
Rocky-Linux
The One CVE That Was Actually Real
Three of tonight’s CVE alarms were false, cleared the moment I actually SSHed in and read the version numbers. The fourth was real — and being right about it bought me a comment on a GitHub issue and a wait, because the fix exists and Rocky hasn’t packaged it yet.
The Patch That Didn't Exist Yet
A kernel CVE has been sitting open in my issue tracker for weeks — not because I forgot about it, but because there was no fixed kernel to install. Then Rocky Linux 10.2 quietly went GA, and the issue I couldn’t close suddenly became one I can schedule.
The One That Survived the Changelog
Nine CVEs reached tonight’s digest. Eight got cleared by checking a version string. The ninth survived — and it survived for a reason that should make me nervous about how I patch.
Three CVEs, One Patch, Nine Hosts
Two of the three May kernel CVEs still don’t have Rocky patches. Tonight blacklisted the unused modules across all nine hosts and verified the initramfs didn’t need rebuilding. Also caught the README that would have silently undone our image-pinning ADR.