Public bug reported:
Package: update-notifier
(also related: update-manager — UpdateList phased-update filtering)
Importance suggestion: Medium
Security vulnerability: NO
Bug Description:
[Impact]
On Ubuntu 26.04.1 (Resolute), `/usr/lib/update-notifier/apt-check
--human-readable` (and the MOTD stamp
`/var/lib/update-notifier/updates-available`) reported:
17 updates can be applied immediately.
1 of these updates is a standard security update.
To see these additional updates run: apt list --upgradable
Following that exact advice, `apt list --upgradable` listed only 13
packages. The announced total is therefore not verifiable with the
command the message recommends.
Root cause (two parts):
1) Counting metric mismatch
apt-check simulates an upgrade via DepCache.upgrade() (saveDistUpgrade) and
counts every package that is marked_install OR marked_upgrade (after skipping
some phased updates). That includes newly installable packages pulled in by a
kernel ABI upgrade, for example:
- linux-image-7.0.0-43-generic
- linux-modules-7.0.0-43-generic
- linux-headers-7.0.0-43*
- linux-tools-7.0.0-43*
- linux-main-modules-*-7.0.0-43-generic
Those packages do not appear in `apt list --upgradable`, which only shows
already-installed packages that have a newer candidate.
2) Misleading helper text
apt_check.py always tells the user to run `apt list --upgradable` whenever
upgrades > 0, even though that command does not enumerate the same set that
apt-check counted.
Additionally, phased updates make the divergence worse in the opposite
direction: some packages appear in `apt list --upgradable` but are excluded
from apt-check (libapt mark_keep and/or UpdateList._is_ignored_phased_update).
On this machine that was:
- base-files (phased; DepCache marked_keep)
- vim-common, vim-tiny, xxd (marked by DepCache, then ignored by UpdateList)
Observed set math on this system:
|apt-check| = 17 = 9 shared + 8 new kernel packages
|apt list| = 13 = 9 shared + 4 phased packages visible only to apt list
intersection = 9
This confuses MOTD / console / SSH login messaging and reduces trust in
update notifications. No crash and no direct security bypass.
[Ubuntu release]
Ubuntu 26.04.1 LTS (Resolute)
Architecture: AMD64
$ lsb_release -rd
Description: Ubuntu 26.04.1 LTS
Release: 26.04
[Package versions]
- update-notifier: 3.207.2
- update-notifier-common: 3.207.2
- update-manager: 1:26.04.5
- python3-apt: 3.1.0ubuntu1.1
$ apt-cache policy update-notifier update-notifier-common update-manager
[Environment]
- Desktop: Ubuntu GNOME / Wayland
- Virtualization: QEMU/KVM
- Kernel running: 7.0.0-42-generic
- Kernel upgrade pending: 7.0.0-43.43 (HWE meta packages)
Important: Observed in a QEMU/KVM guest during desktop QA. The mismatch
is logical (code paths), not hypervisor-specific; a pending kernel ABI
upgrade makes it especially visible.
[Steps to reproduce]
1. Boot Ubuntu 26.04.1 with pending updates that include a new kernel ABI (meta
linux-*-generic-hwe-* upgradable, linux-image-<new-ABI> not yet installed).
Optional: some phased packages also pending.
2. Run:
/usr/lib/update-notifier/apt-check --human-readable
Note the integer N in “N updates can be applied immediately” and the advice
to run `apt list --upgradable`.
3. Run:
apt list --upgradable
4. Compare the count of upgradable lines to N.
5. Optional — raw machine-readable form:
/usr/lib/update-notifier/apt-check 2>&1 >/dev/null
(stderr shows N;S)
6. Optional — confirm MOTD stamp matches apt-check:
cat /var/lib/update-notifier/updates-available
[Expected behavior]
Either:
- the number of updates announced by apt-check matches what `apt list
--upgradable` shows, OR
- the helper text must not claim that `apt list --upgradable` shows “these”
updates; it should describe the metric (upgrade simulation including newly
installable packages) and/or point to a command that lists the same set, OR
- apt-check should report separate counts (e.g. upgrades vs new packages to
install).
[Actual behavior]
- apt-check / updates-available: 17 updates (1 security)
- apt list --upgradable: 13 packages
- 8 packages counted by apt-check are new installs (kernel 7.0.0-43*),
invisible to apt list
- 4 packages shown by apt list are omitted by apt-check due to phasing/keep
- Helper text incorrectly tells the user that apt list will show the announced
updates
[Code pointers]
File: /usr/lib/update-notifier/apt_check.py
- saveDistUpgrade() uses depcache.upgrade() and therefore marks new installs
pulled by the upgrade
- counting loop increments on marked_install OR marked_upgrade (after security
/ phased handling)
- write_human_readable_summary() always appends:
“To see these additional updates run: apt list --upgradable”
Phased filtering also uses
UpdateManager.Core.UpdateList.UpdateList._is_ignored_phased_update.
[Workaround]
Ignore the suggested apt list command when reconciling the MOTD number. Compare
instead against a simulated upgrade (e.g. apt-get -s upgrade / apt upgrade
--simulate), understanding that apt-check also applies UpdateList phased
filtering.
[What I am NOT claiming]
- Not claiming apt-check’s simulation is “wrong” as an internal metric for
“packages that would change in an upgrade”.
- Claiming the user-facing message is wrong/misleading because it equates that
metric with `apt list --upgradable`.
- Not a security vulnerability.
$ apt list --upgradable
Listing...
base-files/resolute-updates 14ubuntu6.3 amd64 [upgradable from: 14ubuntu6.2]
bpftool/resolute-updates 7.7.0+7.0.0-43.43 amd64 [upgradable from:
7.7.0+7.0.0-42.42]
ca-certificates/resolute-updates,resolute-security 20260816ubuntu0.26.04.2 all
[upgradable from: 20260816ubuntu0.26.04.1]
linux-generic-hwe-24.04/resolute-updates 7.0.0-43.43 amd64 [upgradable from:
7.0.0-42.42]
linux-generic-hwe-26.04/resolute-updates 7.0.0-43.43 amd64 [upgradable from:
7.0.0-42.42]
linux-headers-generic-hwe-26.04/resolute-updates 7.0.0-43.43 amd64 [upgradable
from: 7.0.0-42.42]
linux-image-generic-hwe-26.04/resolute-updates 7.0.0-43.43 amd64 [upgradable
from: 7.0.0-42.42]
linux-libc-dev/resolute-updates 7.0.0-43.43 amd64 [upgradable from: 7.0.0-42.42]
linux-perf/resolute-updates 7.0.0-43.43 amd64 [upgradable from: 7.0.0-42.42]
linux-tools-common/resolute-updates 7.0.0-43.43 all [upgradable from:
7.0.0-42.42]
vim-common/resolute-updates 2:9.1.2141-1ubuntu4.10 all [upgradable from:
2:9.1.2141-1ubuntu4.9]
vim-tiny/resolute-updates 2:9.1.2141-1ubuntu4.10 amd64 [upgradable from:
2:9.1.2141-1ubuntu4.9]
xxd/resolute-updates 2:9.1.2141-1ubuntu4.10 amd64 [upgradable from:
2:9.1.2141-1ubuntu4.9]
# Reconciliation 17 vs 13
|apt-check|=17 |apt list|=13 |intersection|=9
ONLY in apt-check (8 new installs):
linux-headers-7.0.0-43
linux-headers-7.0.0-43-generic
linux-image-7.0.0-43-generic
linux-main-modules-v4l2loopback-7.0.0-43-generic
linux-main-modules-zfs-7.0.0-43-generic
linux-modules-7.0.0-43-generic
linux-tools-7.0.0-43
linux-tools-7.0.0-43-generic
ONLY in apt list (4 phased/keep):
base-files
vim-common
vim-tiny
xxd
BOTH (9):
bpftool, ca-certificates, linux-generic-hwe-24.04,
linux-generic-hwe-26.04, linux-headers-generic-hwe-26.04,
linux-image-generic-hwe-26.04, linux-libc-dev, linux-perf,
linux-tools-common
** Affects: update-notifier (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173607
Title:
apt-check reports N updates but points users to `apt list
--upgradable`, which lists a different (smaller) set
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/update-notifier/+bug/2173607/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
