To update Kali Linux, open a terminal and run sudo apt update && sudo apt full-upgrade -y. That one line refreshes the package lists and upgrades every installed tool, kernel included. The rest of this guide is for the moments it does not go that smoothly: the signing-key error that broke thousands of installs in 2025, packages "kept back", lock files, and hash sum mismatches.
Why bother? Because a stale Kali bites at the worst moment: Metasploit crashing on a bug fixed weeks ago, Nmap missing the NSE script you need, or msfvenom syntax that no longer matches the tutorial. If you are new to the distribution itself, HackerDNA's Kali Linux course covers installation, the first boot and the core toolset before you ever need this page.
TL;DR - the Kali Linux update command:
sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y && sudo apt cleanUse full-upgrade, not plain upgrade: Kali is a rolling release and dependencies change constantly. Run it weekly, then reboot if a new kernel was installed. The same command keeps you on the latest release, with nothing separate to install.
Why Kali Uses Rolling Releases (And Why It Matters)
Kali does publish numbered releases (2026.1 in March, 2026.2 in June), but they are quarterly snapshots of the same rolling branch, not upgrades you install separately. There is nothing to download or migrate: your system pulls the latest packages from the kali-rolling repository, so a full upgrade today puts you on the newest release. No reinstall, no upgrade wizard.
Security tools move fast: exploit modules get fixed, scanners gain checks, new tools land every quarter (2026.2 added nine, including legba and penelope). The Kali team builds kali-rolling from Debian Testing and layers hundreds of security tools on top. Setting up a fresh environment for CTFs? Our essential CTF tools guide lists what to add.
The tradeoff? Rolling releases demand regular attention. Skip updates for a few months, and you might face dependency nightmares where Package A needs a newer version of Library B, which conflicts with Package C. Update weekly, and each session takes a few minutes with minimal surprises.
How to Upgrade Kali Linux Safely (apt full-upgrade)
Kali uses APT, the same package manager as Debian and Ubuntu. Three commands matter, and the difference between the last two is the source of most "my Kali is half updated" problems.
apt update: Check What is Available
This command refreshes your local package index. It reaches out to Kali's mirrors and downloads the latest list of available packages, but it does not install anything.
sudo apt updateThink of it like checking the menu at a restaurant. You now know what is available, but you have not ordered yet. Always run this first before upgrading.
apt upgrade: The Cautious Upgrade
This upgrades your installed packages and will pull in new dependencies if needed, but it never removes an installed package. Any upgrade that requires a removal is skipped, and APT tells you so with The following packages have been kept back.
sudo apt upgradeOn a stable server that caution makes sense. On Kali, where libraries get renamed and replaced every few weeks, it leaves you with a half-updated system and a growing list of kept-back packages.
apt full-upgrade: The Real Deal
This is the command you want. It upgrades everything and resolves dependency changes, installing new packages and removing obsolete ones when the upgrade requires it.
sudo apt full-upgrade
The older apt dist-upgrade does the same thing if you have muscle memory from years past. Both work identically.
Bottom line: On Kali, always use apt full-upgrade instead of plain apt upgrade. It is also what the Kali team uses in every release announcement.
How to Update Kali Linux (Step-by-Step)
Here is the full process, step by step. Once you do this a few times, it becomes second nature.
Before You Start
A few quick checks save you from common headaches:
- Verify you are on kali-rolling: Run
grep -rh kali /etc/apt/sources.list /etc/apt/sources.list.d/and confirm you seekali-rolling, notkali-last-snapshot. - Check disk space: Run
df -h /. A few GB free is enough for a weekly update; a VM left alone for months can need 5-10 GB because packages download before they install. - Snapshot your VM: If running in VirtualBox or VMware, take a snapshot now. Rollback takes seconds if something breaks.
- Know your way around the shell: If
cat,df, andsudoare new to you, read our Kali Linux commands cheat sheet first. Updating is easier when the terminal is not the hard part.
Stuck on kali-last-snapshot? If your sources point to kali-last-snapshot instead of kali-rolling, you only get updates when Kali publishes the next quarterly release. That branch is frozen by design. Change the suite to kali-rolling (see Repository Configuration below) if you want continuous updates.
Step 1: Refresh the Package Lists
Fire up your terminal and sync with the repositories:
sudo apt update
Read the last lines. A healthy run ends with something like 1284 packages can be upgraded. Run 'apt list --upgradable' to see them. Lines starting with E: or W: point to network, key or repository problems, covered in the error section below.
Step 2: Run the Full Upgrade
Now pull down and install everything:
sudo apt full-upgrade -y
The -y flag auto-confirms prompts, which saves you from mashing Enter repeatedly. Drop it if you prefer reviewing each change. Grab a coffee if there are hundreds of packages to update.
Step 3: Clean Up Orphaned Packages
Packages installed as dependencies sometimes get left behind when the parent package changes:
sudo apt autoremove -yThis reclaims disk space and keeps your system tidy. It will not touch anything you explicitly installed.
Step 4: Purge the Package Cache
Downloaded .deb files pile up in /var/cache/apt/archives/. Clear them out:
sudo apt clean
If disk space is not tight, apt autoclean keeps recent packages around in case you need to reinstall something quickly.
Step 5: Reboot When Needed
Kernel updates and major system library changes need a reboot to take effect:
sudo reboot
Not sure? If the file /var/run/reboot-required exists, a package has asked for a reboot. As a cross-check that always works, compare the running kernel with the newest installed one: if uname -r prints an older version than the latest /boot/vmlinuz-* file, reboot.
uname -r
ls /boot/vmlinuz-*
After a release upgrade, the Kali team also suggests cp -vrbi /etc/skel/. ~/ to pick up new default shell and desktop configs. It asks before overwriting each file and keeps backups.
The lazy admin special: Chain it all together in one command:
sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y && sudo apt cleanChecking Your Kali Version
Want to confirm the upgrade actually landed you on the latest release? These commands tell you in seconds.
The Quick Check
lsb_release -aOn an up-to-date system you will see something like this:
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2026.3
Codename: kali-rolling
Release is the version stamp of your packages and Codename confirms you are on the rolling branch. Note that the stamp runs one step ahead: Kali bumps it right after each quarterly release, so a fully updated rolling system reports 2026.3 at the time of writing, even though the newest published image is 2026.2.
The Detailed View
cat /etc/os-release
Works even where lsb_release is not installed (minimal images, containers, WSL). Look at the VERSION= line: on an up-to-date rolling system in late September 2026 it reads 2026.3. If it is stuck on 2025.x after a full upgrade, check your sources: you are probably on kali-last-snapshot or pointed at a dead mirror.
The System Overview
hostnamectlA nicely formatted summary showing your OS, kernel version, and architecture. Great for screenshots in reports.
Kernel Specifics
uname -aShows kernel name, version, build date, and architecture. Run this after a reboot to confirm kernel updates applied correctly.
Repository Configuration
APT's source files tell it where to download packages. Getting them wrong leads to update failures or, worse, packages from untrusted sources. Since Kali 2026.2 there are two possible layouts, and which one you have depends on when you installed. The official Kali documentation covers both.
What Your Sources.list Should Contain
Installed before 2026.2 (most systems): /etc/apt/sources.list needs just one line:
deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware
Fresh installs from 2026.2 onward use the newer deb822 format in /etc/apt/sources.list.d/kali.sources:
Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpgBoth work, and upgrading does not convert one into the other. Just do not define the same repository in both files, or APT warns about duplicate sources. Either way, the components give you every official package, including non-free wireless and GPU firmware.
Do Not Mix Debian Repositories
Kali is based on Debian, but adding Debian repos to your sources.list will break your system. Kali packages are modified and tested together. Mixing in upstream Debian packages causes version conflicts and unpredictable behavior. If you need something from Debian, rebuild it for Kali or find an alternative.
Checking Your Configuration
cat /etc/apt/sources.list
ls /etc/apt/sources.list.d/
Extra lines usually mean an old install, a leftover deb cdrom: entry from the installer, or custom sources someone added.
Editing If Needed
sudo nano /etc/apt/sources.list
# or, on a 2026.2+ install:
sudo nano /etc/apt/sources.list.d/kali.sources
Fix the file, save with Ctrl+O, exit with Ctrl+X, then run sudo apt update to refresh.
Resist the temptation: Do not add random third-party repositories from forum posts. That is how you end up with malicious packages or dependency hell. Stick to the official Kali repositories.
How to Fix Kali Update Errors (GPG, Locks, Hash Sum Mismatch)
Even a well-kept Kali hits errors. These are the ones people actually search for, with the fix that works.
GPG Key Errors
This is the big one. In April 2025 the Kali team lost access to its old repository signing key (ED444FF07D8D0BF6) and started signing with a new one (ED65462EC8D5E4C5). Any install that had not picked up the new keyring broke overnight, with an error like one of these:
Missing key 827C8569F2518CC677FECA1AED65462EC8D5E4C5, which is needed to verify signature.
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY ED65462EC8D5E4C5
Because APT cannot verify the repository, apt install cannot fetch the fixed keyring package either. Download the keyring directly, as the official Kali announcement instructs, then update again:
sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg
sudo apt updateThe same fix applies to any future key expiry: the keyring file contains every key currently valid for the Kali archive.
Packages "Kept Back"
The following packages have been kept back means you ran apt upgrade, which refuses upgrades that need to remove something. Run sudo apt full-upgrade instead and read the removal list before you confirm.
"Conflicting distribution" Warning on a Live USB
On a live USB with persistence you may see:
W: Conflicting distribution: file:/run/live/medium kali-last-snapshot Release (expected kali-last-snapshot but got kali-rolling)
It is a warning, not an error: your sources include the USB stick itself as a package source, and its metadata no longer matches. Comment out the line that starts with deb file:/run/live/medium (add a # in front), keep the http.kali.org line, and run sudo apt update again. If the persistent install is badly out of date, re-flashing a current image is often faster.
Broken Packages
When packages fail mid-installation, this usually cleans up the mess:
sudo apt --fix-broken installIt attempts to satisfy broken dependencies and complete interrupted installations.
Lock File Errors
Could not get lock /var/lib/dpkg/lock-frontend means another package process holds the lock, often a second terminal or the desktop's background updater. First find out who:
sudo fuser -v /var/lib/dpkg/lock-frontend /var/lib/dpkg/lockIf a real process shows up, let it finish. If nothing is listed and the lock is left over from a crash or a closed terminal, remove the stale locks and let dpkg finish its interrupted work:
sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock
sudo rm /var/lib/apt/lists/lock /var/cache/apt/archives/lock
sudo dpkg --configure -aNever delete locks while an install is genuinely running: that is how you corrupt the dpkg database.
Out of Disk Space
Updates download packages before installing them. If space runs out:
sudo apt clean
sudo apt autoremove -y
Check your available space with df -h before large update sessions, especially on VMs with small virtual disks.
Slow or Failed Downloads
Mirror congestion happens. Test that you can reach the repository over HTTP (ping is often blocked, so it proves little):
curl -sI http://http.kali.org/kali/dists/kali-rolling/Release | head -n 3
A 302 redirect to a mirror is the normal answer: http.kali.org sends you to a nearby mirror automatically. If downloads still crawl, pick a specific one from the official mirror list.
Hash Sum Mismatch
This happens when mirrors are out of sync or files changed during download:
sudo rm -rf /var/lib/apt/lists/*
sudo apt updateWiping the package lists forces APT to grab fresh copies. If it persists, wait a few hours for mirrors to catch up.
Smart Update Habits
A few simple practices keep update sessions smooth and your system stable.
- Update weekly: Small, frequent updates are easier to troubleshoot than massive quarterly marathons. Set a calendar reminder if needed.
- Read before confirming: APT shows what it plans to install, upgrade, and remove. Glance at that list. If it wants to remove half your tools, something is wrong.
- Never update mid-engagement: Your Nmap works right now. Do not risk breaking it while you are actively scanning a client network. Update before or after, never during.
- Snapshot VMs first: Running Kali in VirtualBox or VMware? Take a snapshot before major updates. If something breaks, rollback takes seconds instead of hours of troubleshooting.
- Test on secondary systems: If you have a lab VM, update that first. Let it cook for a day. If nothing breaks, update your main system.
- Read the release notes: The Kali blog announces changes like the 2025 key rotation and the 2026.2 sources format before they bite you.
Automating Updates (With Caution)
You can schedule updates in root's crontab:
sudo crontab -e
Add a weekly job running Sunday at 2 AM. Scripts should use apt-get (the apt command warns that its interface is not stable for scripts), and DEBIAN_FRONTEND=noninteractive stops a configuration prompt from hanging the job forever:
0 2 * * 0 export DEBIAN_FRONTEND=noninteractive; apt-get update && apt-get -y full-upgrade && apt-get -y autoremove
Not sure what 0 2 * * 0 means? Paste it into our free crontab expression tool.
Fair warning: Automated updates will eventually break something without telling you. Only enable this on systems where you can tolerate unexpected breakage and have recovery plans ready.
Updating Individual Tools
Sometimes you need to update just one package without touching the whole system. APT handles this cleanly.
Upgrade a Single Package
sudo apt update
sudo apt install --only-upgrade nmapSwap "nmap" for whatever tool you need. This upgrades only that package if an update exists. Once updated, check out the Nmap Cheat Sheet for quick command references.
See What Has Updates
apt list --upgradableQuickly scan what would change before committing to a full upgrade.
Find Related Packages
apt search metasploitSearches package names and descriptions. Handy for discovering tools you did not know existed.
Reinstall Default Toolset (Metapackages)
Ran apt autoremove a bit too aggressively and now half your tools are missing? Kali uses metapackages to bundle related tools together. Reinstalling a metapackage brings back everything that should be there.
sudo apt install kali-linux-default
This installs the standard toolset that ships with a default Kali installation. Need more? The kali-linux-large metapackage adds additional tools for comprehensive assessments:
sudo apt install kali-linux-large
You can also use kali-tweaks to manage metapackages through a menu interface. Check the official metapackages documentation for the full list of available bundles, including specialized ones for wireless, web testing, and forensics.
When Fresh Installation Beats Updating
In theory a rolling release never needs a reinstall. In practice, sometimes a fresh image is faster than untangling accumulated cruft, especially when:
- Your system has not been updated in over a year
- Too many custom modifications have created weird conflicts
- Persistent errors resist all troubleshooting attempts
- You inherited someone else's janky Kali installation
- You just want a clean slate without baggage
Before reinstalling, back up your home directory, custom scripts, SSH keys and tool configurations. Kali is a toolkit, so most people keep little personal data on it anyway.
Fresh start: Grab the latest images from kali.org/get-kali and verify the SHA256 checksum before installing.
Tools Are Only Half the Equation
An up-to-date Kali does nothing on its own. The skill is knowing which of those 600-odd tools to reach for and how to read what they tell you, and that only comes from using them on real targets.
The Network Penetration Testing course walks from reconnaissance to exploitation with the same tools you just updated, and every chapter ends on a live target rather than a screenshot.
Legal and Ethical Boundaries
This matters: Get explicit written authorization before touching any system you do not own. Unauthorized access is a crime in virtually every jurisdiction, regardless of your intentions. Practice on legal lab environments instead of production systems.
Kali ships hundreds of security testing tools, and every one of them is illegal to point at a system you are not authorized to test. "I was just learning" is not a legal defense.
- Test only systems you own or have documented permission to test
- Get authorization in writing before starting any engagement
- Follow responsible disclosure if you stumble across vulnerabilities
- Know your local laws around security testing and data handling
- Build skills in legal practice environments, not production systems
Start Here
Updating Kali Linux comes down to sudo apt update && sudo apt full-upgrade -y, a cleanup with apt autoremove, and a reboot when the kernel changes. Do it weekly and each run takes minutes. When it fails, the fix is almost always the keyring, a stale lock or a mismatched source line, all covered above.
Ready to put that updated Kali to work? Scan and root your first target in Learning Lab 102, then browse the full HackerDNA labs catalog. Everything runs in the browser, and you can start on the free tier with no credit card required.
