What a critical update means

How Linux distributions rate the severity of vulnerabilities, and how fast a critical security update should be installed.

Not every vulnerability is equally urgent

Every security fix gets a severity rating, and it's the most useful single signal for deciding how fast to act. The catch is that each distribution uses its own scale:

On top of that, many CVEs carry a CVSS score from 0 to 10, where 9.0 and above counts as critical. CVSS rates the vulnerability in general, while a distribution's rating takes its own builds and defaults into account - a flaw in a feature the distribution doesn't enable may be rated much lower than its CVSS score suggests.

What makes a vulnerability critical

Critical ratings are usually reserved for flaws that are easy to exploit and serious when they are: typically ones that can be triggered remotely, without logging in, and that let an attacker run code on the machine or take it over. A flaw that needs local access or an unusual configuration is usually rated lower, even when the impact is serious.

How fast to act

There's no universal deadline, but a practical rule of thumb looks like this:

• Critical, on a machine exposed to the internet: as soon as possible, ideally the same day. These are the vulnerabilities attackers scan for once they're public.
• Critical or high on internal machines: within days, in the next planned update.
• Everything else: with the regular updates, weekly or monthly depending on how you work.

Severity isn't the only factor. A vulnerability that's known to be actively exploited deserves priority whatever its rating, and a critical flaw in a package you don't actually use - installed but never running - is less urgent than it looks.

Installing isn't always the last step

An updated package doesn't protect a program that's already running with the old version loaded. Services need a restart to pick up a fixed library, and a fixed kernel needs a reboot. Each distribution has tools that list the processes still using outdated files, so you know what to restart. With the services-restart.sh plugin and apt-reboot-required.sh or dnf-reboot-required.sh, OS Checker shows which machines still need a restart.

Getting told when it matters

Critical issues are rare compared to routine updates, which is exactly why they're easy to miss in a long list. OS Checker sends an email alert when a machine gets a new critical issue - once per issue, not every hour - and leaves everything else to the regular report. See Choosing when to update for how to handle the rest.