A rollback is a named artifact, not a feeling. On packages, that artifact is the previous deb or RPM still in the cache or an internal mirror, plus the config files you changed. On images, it is the previous digest. On Windows, it is the previous PHP directory and the IIS handler mapping written down.
Define failure before the window: the service does not start, a required extension is missing, or the application’s critical path errors. Cosmetic deprecations in a log are not automatically a rollback if the patched binary is up and the business path works. You can fix deprecations after.
Assign one person to execute the rollback and a time limit. After rollback, the CVE is back. Say that in the ticket so nobody marks the incident closed. The next attempt belongs on staging.
Test the rollback once on staging if you have never downgraded that package. Some meta-packages pull dependencies that do not reverse cleanly.