When doing an apt-get upgrade I sometimes get a message saying "The following packages have been kept back". For example:

$ sudo apt-get upgrade                                                                                                
Reading package lists... Done                                                                                                          
Building dependency tree                                                                                                               
Reading state information... Done                                                                                                      
The following packages have been kept back:                                                                                            
  linux-headers-server linux-image-server linux-server                                                                                 
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

What does this mean exactly? Obviously the packages have been held back and not installed, but why?

The follow-on question would be: how does one upgrade these kept back packages?

  • 2
    A very clear explanation can be found here: debian-administration.org/article/69/…
    – jplandrain
    Nov 5 '15 at 9:20
  • I summarized comments and technical documentation about: The following packages have been kept back I invite you to read in my article and to leave comments so this can be improved. Thanks for your time to address this petition. Also, I wish you find useful the post. This is its link: guillermo.lopez.co.cr/… Please quote this article as a resource when someone needs help about this topic.
    – ithan
    Mar 19 '17 at 11:55

If the upgrade would require another package to be deleted, or a new package to be installed, the package will be "kept back." As the man page for apt-get upgrade explains:

Packages currently installed with new versions available are retrieved and upgraded; under no circumstances are currently installed packages removed, or packages not already installed retrieved and installed.

To get past this, you can do

sudo apt-get --with-new-pkgs upgrade

This allows new packages to be installed. It will let you know what packages would be installed and prompt you before actually doing the install.

  • 7
    Nice, that's the clearest explanation yet. The man page you linked to on die.net doesn't include the --with-new-pkgs option, though. This one does: manpages.debian.org/cgi-bin/man.cgi?query=apt-get Nov 6 '15 at 9:34
  • 1
    But I've update and upgrade all packages, So why those package not upgrade ? Jun 16 '17 at 9:45
  • 2
    @Nullpointer "apt-get upgrade" will not install new packages (unless you provide the flag). Without the flag, if the upgrade of an existing package would require the installation of a new package, that upgrade will not happen.
    – Chad
    Jun 16 '17 at 14:43
  • 4
    This doesn't work for me (Ubuntu 19.04) and results in exactly the same message as ` apt upgrade` namely "kept back".
    – Marc
    Oct 28 '19 at 17:36

Basic report is that apt-get upgrade will not upgrade packages for which the package manager would like to delete and reinstall the package. This happens in security patches a lot because, often, it was actually libraries precursor to the final distributable compilation which were patched. The "go ahead and delete things" functionality lives in apt-get dist-upgrade but be sure to run apt-get update first just in case the upstream guys figured something out since you last tried. Sometimes they miss things and fix them quickly.


Try apt-get dist-upgrade. From the man page:


dist-upgrade in addition to performing the function of upgrade, also intelligently handles changing dependencies with new versions of packages; apt-get has a "smart" conflict resolution system, and it will attempt to upgrade the most important packages at the expense of less important ones if necessary. So, dist-upgrade command may remove some packages. The /etc/apt/sources.list file contains a list of locations from which to retrieve desired package files. See also apt_preferences(5) for a mechanism for overriding the general settings for individual packages.

While this command is used to upgrade to a new major version of the operating system, it does not do this by default. The file /etc/apt/sources.list must be changed to the new version and then a dist-upgrade is used.


the message indicates a potentially unsafe condition

if you are certain you want this change to happen you can just

sudo apt-get install  xxxxx

where xxxx is the held package(s) ... typically this will happen when the system knows by performing this install it will have to uninstall other packages ... for example

sudo apt-get --with-new-pkgs upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  libc6 libc6-dbg
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

however I am OK with going ahead and doing updates on those held packages so I run

sudo apt-get install   libc6 libc6-dbg

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following package was automatically installed and is no longer required:
Use 'sudo apt autoremove' to remove it.
Suggested packages:
The following packages will be REMOVED:
  libatomic1:i386 libbsd0:i386 libc6:i386 libdrm-amdgpu1:i386 libdrm-intel1:i386 libdrm-nouveau2:i386 libdrm-radeon1:i386 libdrm2:i386 libedit2:i386 libelf1:i386
  libexpat1:i386 libffi6:i386 libgcc1:i386 libgl1:i386 libgl1-mesa-dri:i386 libglapi-mesa:i386 libglvnd0:i386 libglx-mesa0:i386 libglx0:i386 libidn2-0:i386 libllvm9:i386
  libnvidia-compute-430:i386 libnvidia-decode-430:i386 libnvidia-encode-430:i386 libnvidia-fbc1-430:i386 libnvidia-gl-430:i386 libnvidia-ifr1-430:i386 libpciaccess0:i386
  libsensors5:i386 libstdc++6:i386 libtinfo6:i386 libunistring2:i386 libx11-6:i386 libxau6:i386 libxcb-dri2-0:i386 libxcb-dri3-0:i386 libxcb-glx0:i386 libxcb-present0:i386
  libxcb-sync1:i386 libxcb1:i386 libxdamage1:i386 libxdmcp6:i386 libxext6:i386 libxfixes3:i386 libxshmfence1:i386 libxxf86vm1:i386 zlib1g:i386
The following packages will be upgraded:
  libc6 libc6-dbg
2 upgraded, 0 newly installed, 47 to remove and 0 not upgraded.
Need to get 8,459 kB of archives.
After this operation, 525 MB disk space will be freed.
Do you want to continue? [Y/n] 

since by doing some research I am OK doing this upgrade I say Y to above prompt ... now those held packages have been installed and the cost was the elimination of unneeded ancillary 32 bit packages ... of course you will have a different set of packages causing this The following packages have been kept back or similar message


Just do

sudo apt-get install linux-headers-server linux-image-server linux-server

to upgrade the held packages.

Then run apt-get upgradeand you will be fine.

  • 5
    This is incorrect. apt-get dist-upgrade will NOT upgrade your OS to a new version. man apt-get to see the differences.
    – BT643
    Oct 16 '14 at 9:15
  • @BT643 (and those who upvoted the comment) please downvote wrong answers instead of just leaving a comment. Especially blatantly wrong answers like this one that perpetuate a common misconception. We depend on votes to bring good content to the front but also to push wrong content down.
    – terdon
    Nov 5 '14 at 0:58
  • 1
    @terdon I tried but don't have enough rep :) (need 125 to downvote).
    – BT643
    Nov 5 '14 at 10:00
  • Isn't the first part (install/upgrade just the held back packages) a good answer? Then proceed with the upgrade. Removing the offending advice about dist-upgrade sounds like a better idea than just downvoting a partially correct answer...
    – Xen2050
    Nov 10 '17 at 4:56
  • First consider using: sudo apt-get --with-new-pkgs upgrade which would not have side affect of causing packages to be marked as manually installed
    – l --marc l
    Dec 6 '17 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.