Cybersecurity Updates & Tools

patch Command in Linux: Apply Diff Files and Reverse Changes

The patch command in Linux applies a set of changes from a diff file to one or more original files. It is the standard way to distribute source code changes, security fixes, and configuration updates, and pairs directly with the diff command.

This guide covers how to use the patch command in Linux with practical examples.

How the patch Command Works in Linux

patch reads a diff file and applies the changes it describes to the target file. The standard workflow is to generate the patch with diff -u and apply it with patch.

Generate a unified diff:

bashdiff -u hello.py hello_new.py > hello.patch

Apply it to the original file:

bashpatch hello.py hello.patch
patching file hello.py

You can also read the patch from standard input or specify it with -i:

bashpatch -p1 < hello.patchpatch -i hello.patch hello.py

The unified format (diff -u) is what patch expects by default. Non-unified formats require the -c flag. The patch exits with code 0 on full success, 1 if some hunks failed to apply, and 2 on a fatal error such as a missing file.

Apply a Patch, Dry Run, Backup, and Reverse

Dry run before applying. Use --dry-run to verify a patch applies cleanly without touching any files. This is essential before applying patches from external sources or multi-file patches where you are unsure about path alignment:

bashpatch --dry-run hello.py hello.patch

If conflicts exist, patch reports them without making any changes to disk.

Back up the original. Use -b to save the original with a .orig extension before patching. The backup lets you restore the unmodified file manually if the result is wrong:

bashpatch -b hello.py hello.patch

hello.py.orig now contains the pre-patch version.

Reverse a patch. Use -R to undo a previously applied patch and restore the file to its state before the patch was applied:

bashpatch -R hello.py hello.patch

Use -N in automated workflows to skip patches that are already applied. This prevents the interactive “Reversed (or previously applied) patch detected! Assume -R?” prompt.

Strip Path Components, Multi-File Patches, and Troubleshooting

The -p N option strips N leading path components from filenames in the patch header. Patches from git diff prefix filenames with a/ and b/:

--- a/src/utils/hello.py+++ b/src/utils/hello.py

Use -p1 to strip one component (a/ or b/), mapping the path to what exists on disk. Without -p1patch looks for a/src/utils/hello.py, which does not exist:

bashpatch -p1 < hello.patch

-p1 is the standard option for patches from git diff and from diff -u run at the project root.

Multi-file patches. When a patch contains changes to multiple files, omit the target filename. patch reads the filenames directly from the diff headers inside the patch file:

bashpatch -p1 < project.patch

Common errors:

  • Hunk #1 FAILED at line N — the file has been modified since the patch was created, or the wrong version is being patched. patch creates a .rej file with the failed hunks so you can apply them manually
  • Reversed (or previously applied) patch detected! — the changes are already present. Use -N to skip silently in scripts
  • malformed patch at line N — the patch is not in unified format. Regenerate with diff -u

Run patch --dry-run before any multi-file or externally sourced patch. Use -b to keep a backup and -p1 for patches from git diff. Leave a comment below if you run into any issues.