Pending reboot
high on-server
What it inspects
Whether the file /var/run/reboot-required exists (written by Debian and Ubuntu package scripts), and `dnf needs-restarting -r` as root. The file present fails. dnf exit status 1 with its "Reboot is required" message fails, exit status 0 passes. With neither signal, an absent file passes on Debian and Ubuntu; on RHEL-family hosts the file never exists, so if dnf gives no answer the check is skipped rather than passed.
Why it matters
Until the machine reboots, it keeps running the old kernel and old core libraries even though the fixed versions are on disk, so the security updates are not actually protecting it. The reboot is a planned outage, so schedule it deliberately rather than leaving the state open for months.
How to verify
# Debian/Ubuntu: this file exists when a package asked for a reboot, and lists the packages.
ls -l /var/run/reboot-required /var/run/reboot-required.pkgs 2>/dev/null
# RHEL family (needs dnf-plugins-core): exit status 1 means a reboot is required.
sudo dnf needs-restarting -r; echo "exit status: $?"
How to fix
Reboot in a maintenance window. A reboot is downtime, so this is a judgement step with the commands to run.
Schedule a reboot in a maintenance window needs your judgement
Any distro
# A reboot interrupts every service on this machine. Choose a quiet period and tell the people who use it.
# Before you reboot:
# - check that the services you need start at boot: systemctl list-unit-files --state=enabled
# - keep console or out-of-band access in case it does not come back
# - Debian/Ubuntu: see which packages asked for it: cat /var/run/reboot-required.pkgs
# Then reboot now, or schedule it (the +5 is minutes, and a message is shown to logged-in users):
# shutdown -r +5 'scheduled reboot for updates'
# Cancel a scheduled reboot with: shutdown -c
# After it comes back, this check passes: the Debian file /var/run/reboot-required is gone after a reboot, and
# `dnf needs-restarting -r` reports no reboot needed.
# Live-patching services (for example Canonical Livepatch) protect against some kernel bugs between reboots,
# but they do not clear this flag.