There are 2 paths to patching SQL server. Either the SQL CU (cumulative) upgrade or GDR (critical) upgrade.
CU includes functionality fixes and security fixes (https://support.microsoft.com/en-us/topic/kb4047329-sql-server-2017-build-versions-346e8fcd-c07c-5eeb-e10b-e3411ba8d8dd#cu)
GDR only includes security/critical fixes (https://support.microsoft.com/en-us/topic/kb4047329-sql-server-2017-build-versions-346e8fcd-c07c-5eeb-e10b-e3411ba8d8dd#gdr)
Example: Assuming I am on RTM, then it is clear that if I apply CU29 (KB5010786) then I get the cumulative updates from start upto CU29 including the functionality fixes and security fixes.
Within the GDR table, I can see CU-GDR and GDR
Assuming I have RTM, then, does installing GDR (KB5014354) only apply that 1 fix?, and applying CU29 GDR (KB5014553) apply this & all previous fixes?
The table header (1st column) on both the tables (CU and CU-GDR/GDR) says
Cumulative and this is adding to my confusion because -> if both CU-GDR and GDR are cumulative, then what is the difference between CU-GDR and GDR? Example: When would I choose
GDR (the record under the CU-GDR29 in the table)?
I glanced through the documentation in the links given at the bottom of the above link, but couldn't find an answer to my question.