When doing an apt-get upgrade I sometimes get a message saying "The following packages have been kept back". For example:

$ sudo apt-get upgrade                                                                                                
Reading package lists... Done                                                                                                          
Building dependency tree                                                                                                               
Reading state information... Done                                                                                                      
The following packages have been kept back:                                                                                            
  linux-headers-server linux-image-server linux-server                                                                                 
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

What does this mean exactly? Obviously the packages have been held back and not installed, but why?

The follow-on question would be: how does one upgrade these kept back packages?

  • 1
    A very clear explanation can be found here: debian-administration.org/article/69/… – jplandrain Nov 5 '15 at 9:20
  • I summarized comments and technical documentation about: The following packages have been kept back I invite you to read in my article and to leave comments so this can be improved. Thanks for your time to address this petition. Also, I wish you find useful the post. This is its link: guillermo.lopez.co.cr/… Please quote this article as a resource when someone needs help about this topic. – ithan Mar 19 '17 at 11:55

If the upgrade would require another package to be deleted, or a new package to be installed, the package will be "kept back." As the man page for apt-get upgrade explains:

Packages currently installed with new versions available are retrieved and upgraded; under no circumstances are currently installed packages removed, or packages not already installed retrieved and installed.

To get past this, you can do

sudo apt-get --with-new-pkgs upgrade

This allows new packages to be installed. It will let you know what packages would be installed and prompt you before actually doing the install.

  • 6
    Nice, that's the clearest explanation yet. The man page you linked to on die.net doesn't include the --with-new-pkgs option, though. This one does: manpages.debian.org/cgi-bin/man.cgi?query=apt-get – Charles Roper Nov 6 '15 at 9:34
  • 1
    But I've update and upgrade all packages, So why those package not upgrade ? – Nullpointer Jun 16 '17 at 9:45
  • 2
    @Nullpointer "apt-get upgrade" will not install new packages (unless you provide the flag). Without the flag, if the upgrade of an existing package would require the installation of a new package, that upgrade will not happen. – Chad Jun 16 '17 at 14:43

Basic report is that apt-get upgrade will not upgrade packages for which the package manager would like to delete and reinstall the package. This happens in security patches a lot because, often, it was actually libraries precursor to the final distributable compilation which were patched. The "go ahead and delete things" functionality lives in apt-get dist-upgrade but be sure to run apt-get update first just in case the upstream guys figured something out since you last tried. Sometimes they miss things and fix them quickly.


Try apt-get dist-upgrade. From the man page:


dist-upgrade in addition to performing the function of upgrade, also intelligently handles changing dependencies with new versions of packages; apt-get has a "smart" conflict resolution system, and it will attempt to upgrade the most important packages at the expense of less important ones if necessary. So, dist-upgrade command may remove some packages. The /etc/apt/sources.list file contains a list of locations from which to retrieve desired package files. See also apt_preferences(5) for a mechanism for overriding the general settings for individual packages.

While this command is used to upgrade to a new major version of the operating system, it does not do this by default. The file /etc/apt/sources.list must be changed to the new version and then a dist-upgrade is used.


Just do

sudo apt-get install linux-headers-server linux-image-server linux-server

to upgrade the held packages.

Then run apt-get upgradeand you will be fine.

  • 5
    This is incorrect. apt-get dist-upgrade will NOT upgrade your OS to a new version. man apt-get to see the differences. – BT643 Oct 16 '14 at 9:15
  • @BT643 (and those who upvoted the comment) please downvote wrong answers instead of just leaving a comment. Especially blatantly wrong answers like this one that perpetuate a common misconception. We depend on votes to bring good content to the front but also to push wrong content down. – terdon Nov 5 '14 at 0:58
  • 1
    @terdon I tried but don't have enough rep :) (need 125 to downvote). – BT643 Nov 5 '14 at 10:00
  • Isn't the first part (install/upgrade just the held back packages) a good answer? Then proceed with the upgrade. Removing the offending advice about dist-upgrade sounds like a better idea than just downvoting a partially correct answer... – Xen2050 Nov 10 '17 at 4:56
  • First consider using: sudo apt-get --with-new-pkgs upgrade which would not have side affect of causing packages to be marked as manually installed – l --marc l Dec 6 '17 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.