Updated: 28 September 2026 · Applies to: microcode_ctl and linux-firmware on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; intel-microcode and amd64-microcode on Ubuntu 24.04 and 26.04 and Debian 13 (physical x86_64 servers)
Processor microcode is small firmware inside the CPU. Intel and AMD release updates to fix bugs and security problems such as Spectre-type vulnerabilities. Linux loads the newest microcode early at every boot, so keeping it current is a matter of updating a package and rebooting. This applies to physical servers: on a VPS, the microcode is the host's job and you cannot change it.
1. See the current microcode
grep -m1 microcode /proc/cpuinfo journalctl -k -b | grep -i microcode
The first line shows the revision in use. The kernel log shows whether an update was applied at boot, for example "updated early: 0x2b000603 -> 0x2b000639".
2. Update it: AlmaLinux, Rocky Linux and RHEL
Intel microcode comes in the microcode_ctl package and AMD microcode in linux-firmware; both are installed by default on physical servers.
dnf upgrade microcode_ctl linux-firmware reboot
The package update rebuilds the initramfs with the new microcode, and the reboot loads it.
3. Update it: Ubuntu and Debian
apt install intel-microcode # Intel CPUs apt install amd64-microcode # AMD CPUs reboot
On Debian, these packages are in the non-free-firmware section, which the Debian 12 and 13 installers enable by default. Later updates arrive with apt upgrade.
4. Check after the reboot
Run the commands from step 1 again: the revision should be the new one. To see which CPU vulnerabilities the kernel considers mitigated:
grep -r . /sys/devices/system/cpu/vulnerabilities/
Loading without a reboot
Loading microcode while the system runs ("late loading") is possible in some cases but not recommended by the kernel developers, and it is disabled in many current kernels. Plan a reboot instead.
BIOS updates
Server vendors also ship microcode inside BIOS or UEFI firmware updates, which apply even before Linux starts. On a rented dedicated server, contact support before flashing firmware yourself: a failed update can leave the server unable to boot, and the provider may already have a tested version.
Official documentation: The Linux microcode loader (kernel documentation).
Ucartz services for this topic
- KVM VPS hosting: NVMe SSD and full root access, with Free Basic Managed Support.
- Unmanaged dedicated servers: full root access and free IPMI KVM, with Free Basic Managed Support.
- Linux server management: hardening, patching, monitoring and automation for Ubuntu, Debian, RHEL and AlmaLinux.
