Why? You could come ask here. You could also turn off the server.
Don’t take complex decisions when you panic
A quick search (or in this forum) would have led you to a manual mitigation of the issue while waiting for a proper update.
I don’t know where you got the news from, but most of them had that mitigation step in the same article, even the original github post had it 
Bonjour,
J’aurai également aimé mettre a jour mon système mais Yunohost m’indique que tout est à jour, un apt update / upgrade me dit la même chose. Un uname -a m’indique Linux 5.10.0-21-amd64 #1 SMP Debian 5.10.162-1 (2023-01-21) x86_64 GNU/Linux
Enfin dans le source.list d’apt j’ai ça :
deb http://ftp.debian.org/debian` bookworm main contrib deb-src http://ftp.debian.org/debian bookworm main contrib non-free-firmware`
## YunoHost repository
deb [signed-by=/usr/share/keyrings/yunohost-bookworm.gpg] http://forge.yunohost.org/debian/` bookworm stable deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware`
deb http://security.debian.org/debian-security` bookworm-security main contrib non-free non-free-firmware deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware`
# bookworm-updates, previously known as 'volatile'
deb http://ftp.debian.org/debian` bookworm-updates main contrib non-free non-free-firmware deb-src http://ftp.debian.org/debian bookworm-updates main contrib non-free non-free-firmware`
Là je dois dire que je ne comprends pas bien pourquoi il ne retrouve aucune mise à jour et qu’il m’est impossible de corriger cette faille rapidement…
I’m having the same problem as the previous poster. I’ve updated and it says:
Nothing to do. Everything is already up-to-date.
…but uname -r shows:
Linux MYDOMAIN 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
So, how to get the updates?
Hi, same for me here. I run Yunohost on a RPi 3B+.
My confg:
yunohost:
repo: stable
version: 12.1.40.1
yunohost-admin:
repo: stable
version: 12.1.14
yunohost-portal:
repo: stable
version: 12.1.2
moulinette:
repo: stable
version: 12.1.3
ssowat:
repo: stable
version: 12.1.1
/etc/apt/sources.list content is:
deb http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free rpi firmware
uname -a returns:
Linux MYDOMAIN 6.12.20-v7+ #1867 SMP Wed Mar 26 12:45:01 GMT 2025 armv7l GNU/Linux
I did update, upgrades and reboot.
Yunohost or Debian blocks kernel updates unless they are strictly necessary. This is a core feature of Debian. This topic talk about this issue.
To force a kernel update on a Debian system running Yunohost, you need to enter the following command :
apt update && sudo apt install linux-image-amd64
before you can check if a new kernel is available with :
apt policy linux-image-amd64
On my RPi 3B+, sudo apt policy linux-image-amd64 returns:
N: Unable to locate package linux-image-amd64
but it is not running Debian but Raspbian.
This isn’t true anymore, that statement is really old and outdated.
Debian (and therefore Yunohost) updates kernel regularly, simply using the webadmin updates section will update the kernel, then it’s necessary to reboot to start using the latest kernel.
Maybe… but in my case the kernel was stuck in 5.10.162-1 :
A dpkg -l linux* | grep ii returned this :
ii linux-base 4.9 all Linux image base package
ii linux-image-5.10.0-21-amd64 5.10.162-1 amd64 Linux 5.10 for 64-bit PCs (signed)
ii linux-libc-dev:amd64 6.1.174-1 amd64 Linux support headers for userspace development
An apt policy linux-image-amd64 returned this :
linux-image-amd64:
Installé : (aucun)
Candidat : 6.1.174-1
Table de version : 6.1.174-1 500 https://security.debian.org/debian-security` bookworm-security/main amd64 Packages 6.1.170-3 500 500 https://deb.debian.org/debian bookworm/main amd64 Packages 5.10.162-1 -1 100 /var/lib/dpkg/status
Neither the Yunohost admin panel nor apt-upgrade could find the new kernel. However, running the command apt update && sudo apt install linux-image-amd64 forced the installation of the new kernel that was pending.
No, that’s not the case.
Here, I’m offering a solution that works and is risk-free. I could easily have done nothing and kept the solution to myself.
That sort of answer isn’t helpful, and does even less to encourage people to help out on this forum.
On Rasberry CPU is ARM not X86 AMD64. You should use : apt update && sudo apt install linux-image-arm64
Replace “adm64” by “arm64”
This would probably break the other user’s RPi boot. Raspberry pi uses a different kernel.
@marco you could run apt policy linux-image-rpi-v7 to check the latest kernel, and sudo apt update && apt full-upgrade (or update using the webadmin updates section) to upgrade if necessary.
However AFAIK the raspberry pi kernel hasn’t fixed dirty frag yet, you can still mitigate that risk manually if you want to.
My understanding is that:
- Dirty frag (CVE-2026-43284 & CVE-2026-43500) is fixed (https://forums.raspberrypi.com/viewtopic.php?p=2375559#p2375559)
- Copy fail (CVE-2026-31431) also (https://forums.raspberrypi.com/viewtopic.php?p=2375558#p2375558)
using kernel 6.12.87+rpt-rpi-2712.
But on my side, I’m stuck to 6.12.20-v7+
Why? Do my /etc/apt/sources.list not correct?
deb http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib
Command sudo apt policy linux-image-rpi-v7 shows:
sudo apt policy linux-image-rpi-v7
linux-image-rpi-v7:
Installed: (none)
Candidate: 1:6.12.87-1+rpt1~bookworm
Version table:
1:6.12.87-1+rpt1~bookworm 500
500 http://archive.raspberrypi.org/debian bookworm/main armhf Packages
How could I install this kernel update?
What do you mean by: “This would probably break the other user’s RPi boot. Raspberry pi uses a different kernel.“?
Exactly that, raspberry pi uses a different kernel, not the regular linux-image-arm64, installing that kernel will almost certainly break the boot.
Try this command instead apt policy raspberrypi-kernel
it shows
raspberrypi-kernel:
Installed: 1:1.20230405-1
Candidate: 1:1.20230405-1
Version table:
*** 1:1.20230405-1 500
500 http://archive.raspberrypi.org/debian bookworm/main armhf Packages
100 /var/lib/dpkg/status
So it means that the one installed is the last one.
My VPS runs it in a container yes, but from what they tell me, every cold boot it copies the latest kernel/init.rd over from /boot. Now I’ve done:
apt update && sudo apt install linux-image-amd64
sudo yunohost tools upgrade system
and now, after a cold boot apt policy linux-image-amd64 returns:
linux-image-amd64:
Installed: 6.1.174-1
Candidate: 6.1.174-1
Version table:
*** 6.1.174-1 500
500 http://security.debian.org/debian-security` bookworm-security/main amd64 Packages 100 /var/lib/dpkg/status`
but uname -r still returns:
6.1.0-49-amd64
The thing is, it sounds like even 6.1.174 wouldn’t be enough to be secure, and yet Yunohost doesn’t seem to pick up anything more recent?
That’s correct, unfortunately the raspberrypi-kernel package is unmaintained nowadays, the good news is that you should be able to migrate to the newer linux-image-rpi-v7.
I haven’t done it myself (because I started with bookworm) but this should be the steps:
1- Backup the boot folder just in case sudo cp -a /boot /boot-backup
2- Install the newer kernel sudo apt install linux-image-rpi-v7
3- Reboot sudo reboot or sudo shutdown -r
4- After reboot check uname -a yo should see something like “6.12.87-v7+”
4.1- If there is anything wrong at this point, it shouldn’t be too serious but don’t continue with step 5
5- If that is verified, you can safely remove the old kernel with sudo apt remove raspberrypi-kernel, and reboot again
Did you reboot after installing v6.1.174-1?
Check this post, I think it might be a similar case, basically it depends on the server’s configuration and what kernel it loads, don’t hesitate to ask for more information from your VPS provider:
Thanks for explaining that.
It all makes me a bit nervous…
I think I’ll wait a while.
did you upgrade your yunohost install from bullseye to bookworm in the past? I did an was stuck on
>uname -r
6.1.21-v8+
on a RPi4, delivered by the package raspberrypi-kernel (v1:1.20230405-1).
I was able to upgrade to 6.12.93+rpt-rpi-v8 by following these instructions:
https://forums.raspberrypi.com/viewtopic.php?t=380470#p2274418
For your RPi 3B running on 32bit, you have to replace v8 by v7.
For a full bullseye->bookworm upgrade, more steps might be required, as listed here
Note, the regular yunohost bullseye->bookworm upgrade process might have covered some parts of the procedure, I did not check.
Thanks for your feedback @yunohoster3456
Yes, I switched from bulleye to bookworm in the past.
One my side, it was correct, no big issue during the migration (Thanks to the Yunohost developers, testers and the community for their amazing work 
).
I think what you propose is beyond my skills. I don’t want to break everything, especially since I have services I care about that are running on this RPi.