Upgrading Kali Linux never needs a reinstall or a release-upgrade tool. Each Kali release is a snapshot of the kali-rolling repository, so a box pointed at kali-rolling reaches the latest release with one apt full-upgrade and a reboot. What goes wrong is everything around that command: a sources file in the old format, an upgrade that dies halfway, new tools you expected and never got, and a database that complains about glibc once the dust settles.
This guide shows how to update Kali Linux the way Kali documents it, on a VM left six weeks without updates. You check the version and the deb822 kali.sources file, run a 916-package full-upgrade, refresh dotfiles from /etc/skel, reboot, then install the new tools from the latest release, because the upgrade does not add them. Every command and output below comes from a Kali rolling 2026.3 VM with kernel 7.1.5, upgraded in October 2026.
What You Need
The upgrade asks few questions, but it pulls a lot of data and restarts services under you, so prepare for that before you type anything:
- A Kali install of any age with sudo access
- About 5 GB free on
/(our run downloaded 2,019 MB of packages) - A VM snapshot, or a backup of your home directory on bare metal
- A session that survives a disconnect: tmux, screen or the local console
Don’t skip the last item. Our VM was driven through the QEMU guest agent, and qemu-guest-agent itself was one of the packages being upgraded, so every remote command we sent during the configure phase failed with “Server disconnected without sending a response”. We had started the upgrade with nohup, so it kept running while we were locked out. Over SSH the same thing applies: start tmux first, run the upgrade inside it, and reattach if the link drops. The Kali updating docs also advise against upgrading in the middle of an engagement, which is good advice when a tool update can change behavior you’re relying on.
Check Your Current Kali Version
Record the version and kernel before you change anything, so you have something to compare against after the reboot:
grep VERSION /etc/os-release
uname -rOur VM, cloned from a template built in September, already reported 2026.3 and kernel 7.1.5:
VERSION_ID="2026.3"
VERSION="2026.3"
VERSION_CODENAME=kali-rolling
7.1.5+kali-amd64People misread that output all the time. The VERSION field comes from the base-files package, and Kali bumps it in kali-rolling weeks before the release announcement, so a box can say 2026.3 and still be hundreds of packages behind. It was here: 916 upgrades were waiting. Treat the version string as a label, and use apt list --upgradable as the real answer to “am I up to date?”
Point APT at kali-rolling
Since Kali 2026.2 the network repository lives in a deb822 file, /etc/apt/sources.list.d/kali.sources, and new network installs no longer ship /etc/apt/sources.list. Check which one you have:
ls /etc/apt/sources.list /etc/apt/sources.list.d/If only kali.sources shows up, open it and confirm the suite is kali-rolling:
sudo vim /etc/apt/sources.list.d/kali.sourcesThe file on our VM matched the default from the Kali APT sources documentation exactly:
# See https://www.kali.org/docs/general-use/kali-apt-sources/
Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpgAn older install still has the one-line deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware entry in sources.list. That still works, but APT can convert it for you, and it keeps a backup of the old file:
sudo apt modernize-sourcesWe tested the conversion by putting the legacy line back on the VM. APT asked once, wrote the deb822 file and filled in the keyring path itself:
The following files need modernizing:
- /etc/apt/sources.list
Modernizing will replace .list files with the new .sources format,
add Signed-By values where they can be determined automatically,
and save the old files into .list.bak files.
...
Rewrite 1 sources? [Y/n] y
Modernizing /etc/apt/sources.list...
- Writing /etc/apt/sources.list.d/kali.sourcesWhichever format you end up with, the suite must read kali-rolling. A box on kali-last-snapshot only moves when a release ships, and one still pointing at a third-party mirror or an old codename won’t move at all. Our guide to adding the official Kali repositories covers mirror and branch choices in more depth.
Refresh the Package Index
Pull the current package lists so APT knows what the latest release contains:
sudo apt updateLook at the last line first. Six weeks of drift came to 916 packages:
Get:1 http://kali.download/kali kali-rolling InRelease [34.0 kB]
Get:2 http://kali.download/kali kali-rolling/main amd64 Packages [21.8 MB]
Get:3 http://kali.download/kali kali-rolling/main amd64 Contents (deb) [54.3 MB]
...
Fetched 77.6 MB in 9s (9,081 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
916 packages can be upgraded. Run 'apt list --upgradable' to see them.A NO_PUBKEY error at this point means your archive keyring is older than the key that signed the repository, so APT refuses the new package lists and the upgrade has nothing to work from. Install the current keyring with sudo apt install kali-archive-keyring, then run apt update again. Our VM’s keyring was current, so it never hit this.
Run the Full Upgrade
Use full-upgrade, never plain upgrade. apt upgrade installs new dependencies but never removes a package, and apt-get upgrade refuses both, so on a rolling distro either one leaves updates behind. A simulated apt-get -s upgrade on our VM would have upgraded 840 packages and kept back 76, among them cherrytree, clang-21, faraday, freerdp3-x11 and gvmd. Most of them are packages whose library dependencies moved.
Start the upgrade inside tmux:
sudo apt full-upgrade -yBefore it downloads anything, APT prints a summary. Read the REMOVING block before you let it run: a package you rely on showing up there is your cue to stop and investigate. Ours removed only superseded libraries:
REMOVING:
libblosc2-7 libgvm22t64 libshiboken6-py3-6.10
libfalcosecurity0t64 libpyside6-py3-6.10 python3-pkg-resources
Summary:
Upgrading: 916, Installing: 27, Removing: 6, Not Upgrading: 0
Download size: 2,019 MB
Freed space: 414 MBThe download took 1 minute 45 seconds at 19.2 MB/s, and the whole run took about 20 minutes on a 4-core VM, most of it spent unpacking and running triggers (initramfs, GRUB, man-db, Java certificates). The kernel stayed on 7.1.5 because no newer kernel had landed yet, but plenty of tools you use daily did move:
- metasploit-framework 6.5.3 to 6.5.7
- burpsuite 2026.8 to 2026.9
- nmap 7.99 to 7.991
- openssh-server 10.4p1 to 10.6p1
- systemd 261.2 to 262, glibc 2.43-4 to 2.43-7
Even a version label that never changed hid a new Metasploit and a new SSH server, so an upgrade between releases is not a cosmetic step. If you script against tool output, rerun your scripts after an upgrade like this one before you trust them on a job.
We ran the scripted form of the same command, which accepts the defaults and keeps any config file you have edited. Use it for unattended or Ansible-driven upgrades:
sudo DEBIAN_FRONTEND=noninteractive apt -y full-upgrade -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confoldThe screenshot below puts that command next to the summary from its log and the package that asked for a reboot:
Our log shows 30 “Installing new version of config file” lines, including /etc/login.defs, /etc/john/john.conf, /etc/sqlmap/sqlmap.conf and /etc/snmp/snmpd.conf. Our scripted flags would have kept any edited file, but this VM had none, so dpkg simply installed the new versions. dpkg only stops to ask when you edited a file locally and the package also ships a change to it. In that case the interactive run shows a “Configuration file … Modified (by you or by a script) since installation” prompt. Press D to see the diff, then keep your version for anything you tuned, such as a custom john.conf, and take the maintainer’s version for the rest.
Recover an Interrupted Upgrade
If the upgrade dies partway (a dropped session without tmux, a power cut, a full disk), packages are left unpacked but not configured, and the next APT command refuses to run. This page’s April run from 2025.4 to 2026.1 hit exactly this when the guest agent restarted mid-upgrade. The next apt call printed:
E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.Finish configuring what was unpacked, repair any broken dependencies, then run the full upgrade again so the packages that never started get their turn:
sudo dpkg --configure -a
sudo apt --fix-broken install -y
sudo apt full-upgrade -yThen confirm nothing is left half-installed. sudo dpkg --audit prints nothing and exits 0 on a clean system, which is what our VM returned after this run.
Refresh Shell Dotfiles from /etc/skel
APT updates the default dotfiles in /etc/skel, but it never touches the copies in your home directory, so a new prompt or Zsh setting from a release won’t reach you on its own. Kali’s release notes give this copy step for that:
cp -vrbi /etc/skel/. ~/The -i flag asks before each overwrite and -b keeps the old file with a ~ suffix, so answering yes is reversible until you run the copy again, which overwrites those backups. Our user got 15 files this way, including .zshrc, .bashrc, .profile and an Xfce panel genmon config:
...
'/etc/skel/./.profile' -> '/home/josphat/./.profile' (backup: '/home/josphat/./.profile~')
'/etc/skel/./.zshrc' -> '/home/josphat/./.zshrc' (backup: '/home/josphat/./.zshrc~')
'/etc/skel/./.bashrc' -> '/home/josphat/./.bashrc' (backup: '/home/josphat/./.bashrc~')If you’ve built up aliases in .zshrc, answer n for that file and compare it against /etc/skel/.zshrc by hand, or merge your aliases back from the .zshrc~ backup afterwards.
Reboot and Confirm the Upgrade
Packages that need a restart write /var/run/reboot-required, and the list of packages that asked is in reboot-required.pkgs. On our run it was dbus, and a dbus update is reason enough to reboot even when the kernel hasn’t changed. Kali’s release notes use sudo reboot -f here, but -f skips the orderly service shutdown, which kills PostgreSQL instead of stopping it. Use a plain reboot that only fires when the flag exists:
[ -f /var/run/reboot-required ] && sudo rebootOnce it is back, check the version, the kernel, the reboot flag and whether anything is still pending:
grep VERSION /etc/os-release
uname -r
ls /var/run/reboot-required
sudo apt updateNo reboot flag is left and APT has nothing left to do, which is the real confirmation:
VERSION and the kernel read the same as before the upgrade, and that is expected here, because the label had already moved to 2026.3. On a box coming from 2026.2 or older, VERSION changes to 2026.3 and uname -r moves to the 7.1.5 kernel. “All packages are up to date” is the line that proves the upgrade, whatever the label says. systemctl --failed came back empty on our VM after the reboot.
Install the Kali 2026.3 Tools (Latest Release)
Kali 2026.3 is a build-scripts release with a modest package delta. These are the changes that reach an upgraded system:
- Kernel 7.1.5, up from 6.19 in 2026.2
- KDE Plasma 6.7 on the KDE edition
- 126 package updates and six new tools
build-in-container.shin each refreshed build-script repo, which builds images inside Docker or Podman
The new tools are the part people get wrong. full-upgrade only upgrades what’s installed, and none of the six are in kali-linux-default, so before our install dpkg-query returned “no packages found” for every one of them, even after the 916-package upgrade. Install them by name:
sudo apt install -y dalfox katana qsreplace rustscan sdrangel snaffler-ngAPT pulled 83 packages and 189 MB, Qt WebEngine libraries among them. Leave sdrangel off the line if you have no SDR hardware. These are the versions that landed:
| Package | Installed version | What it does | Command |
|---|---|---|---|
| dalfox | 3.2.4-0kali1 | XSS scanner built for automation | dalfox |
| katana | 1.8.0-0kali1 | Crawling and spidering framework | katana |
| qsreplace | 0.0.3-0kali1 | Replaces query string values in URLs read from stdin | qsreplace |
| rustscan | 2.4.1-0kali1 | Fast port scanner that hands results to nmap | rustscan |
| sdrangel | 7.27.2+dfsg-1+b1 | Qt front end for SDR devices | sdrangel |
| snaffler-ng | 1.5.13-0kali1 | Finds credentials and sensitive files on SMB shares | snaffler |
Two details from the install matter if you script anything. The snaffler-ng package installs its binary as /usr/bin/snaffler, not snaffler-ng. The packaged RustScan 2.4.1 also reports itself as rustscan 2.3.0 when you run rustscan --version, so a version check in a script will think it’s older than it is. If you want the whole default toolset rather than picking tools, our Kali Linux install guide covers the metapackages chosen at install time.
Fix Errors the Upgrade Left Behind
The upgrade finished with no APT errors, but one warning repeated through the log, and it is one that every Kali box carrying a PostgreSQL cluster from an older image will see.
WARNING: database “postgres” has a collation version mismatch
PostgreSQL first printed it while the faraday package configured itself, and it then repeated on every psql call and four times during msfdb init:
WARNING: database "postgres" has a collation version mismatch
DETAIL: The database was created using collation version 2.42, but the operating system provides version 2.43.
HINT: Rebuild all objects in this database that use the default collation and run ALTER DATABASE postgres REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.The PostgreSQL 18 cluster was created when the system ran glibc 2.42, and glibc is now 2.43. Text sort order can change between glibc versions, which is why PostgreSQL warns: an index built under the old rules can return wrong results for range scans. Metasploit’s database still initialised, but don’t just silence the warning. Rebuild the indexes and then record the new version, once for each database the warning names. Kali doesn’t start PostgreSQL at boot, so check that pg_lsclusters shows the cluster as online first (sudo pg_ctlcluster 18 main start brought ours up after the reboot):
sudo -u postgres psql -d postgres -c 'REINDEX DATABASE postgres;' -c 'ALTER DATABASE postgres REFRESH COLLATION VERSION;'
sudo -u postgres psql -d template1 -c 'REINDEX DATABASE template1;' -c 'ALTER DATABASE template1 REFRESH COLLATION VERSION;'Each database confirms the change, and pg_database then shows 2.43 across the board, including the msf databases created after the upgrade:
REINDEX
NOTICE: changing version from 2.42 to 2.43
ALTER DATABASE
datname | datcollversion
-----------+----------------
msf | 2.43
template0 |
msf_test | 2.43
postgres | 2.43
template1 | 2.43On PostgreSQL 16 and later, REINDEX DATABASE skips the system catalog indexes, so add REINDEX SYSTEM postgres; (and the same for each database) if you want those rebuilt too. If you already ran msfdb init on the old glibc, run the same two commands for msf and msf_test as well. Check with SELECT datname, datcollversion FROM pg_database; and fix any row still on the old version.
The following packages have been kept back
APT prints this when you use upgrade instead of full-upgrade. With apt-get upgrade it holds back anything that needs a new package or a removal, and with apt upgrade anything that needs a removal. Our apt-get -s upgrade simulation kept back 76 packages, and full-upgrade took all of them. If full-upgrade itself still lists packages as not upgraded, run apt update again, because a mirror caught mid-sync can briefly serve a package without its new dependency. Then repeat the upgrade.
Clean Up Old Packages
Every upgrade leaves behind libraries that nothing depends on anymore. APT lists them at the top of the full-upgrade output, and on our run there were 13 (old FFmpeg, gRPC and protobuf libraries, plus chromium-sandbox). Remove them:
sudo apt autoremove -yAutoremove freed 133 MB. It does not remove the previous kernel: our VM still carries linux-image-6.19.14+kali-amd64 alongside 7.1.5, and that’s the fallback you want to keep in the GRUB “Advanced options” menu until the new kernel has booted cleanly a few times. You don’t need apt clean afterwards either: the apt command deletes downloaded packages once they install, and /var/cache/apt/archives held 92 KB and no .deb files after our 2 GB run. Only apt-get keeps them.
Keep Kali Current Between Releases
Six weeks without updates turned into 916 packages and 2 GB on this VM, and this page’s earlier run, which spanned two releases, touched more than 1,800. The size of the jump is what makes upgrades risky, not the release number, so the habit that matters is a small update every week or two:
sudo apt update && sudo apt full-upgrade -yPair it with a VM snapshot before each run if Kali lives in a hypervisor, which is how our Proxmox pentest lab handles it. If you need a toolset that stays frozen through an engagement, switch the suite to kali-last-snapshot instead of skipping updates, and switch back when the work is done. Kali Purple tracks the same repository, so a Kali Purple install upgrades the same way, and so does any box you set up after comparing Parrot OS and Kali. After a kernel jump, check that wireless injection still works. Our list of Wi-Fi adapters for Kali marks which chipsets use in-kernel drivers and which need a DKMS build, and a DKMS module has to rebuild against every new kernel. For the bigger picture beyond package management, the Kali Linux books roundup is where we’d start.
