Patch windows, CVE queues, service restarts, reboot debt, exposed ports, compliance evidence, and the messy gap between “updated” and “fixed.”
Package updates can fix files on disk while old code keeps running in long-lived processes. Here is how restart debt happens on Linux, how to inspect it, and why it matters after a patch window.
A practical RHEL-family workflow for using Ansible to collect host, kernel, package, restart debt, deleted library mappings, and listening service evidence into a CSV after a patch window.
Package managers show what changed on disk. They do not always show whether long-running services still have old libraries mapped in memory, or whether a host is still booted into the vulnerable kernel.