IMHO there have been a number of noteworthy changes in Oracle database patching lately. I thought I would put them in writing as a reference.
First, some vocabulary:
BP: Bundle Patch: contains both new features and fixes
PSU: Patch Set Update: contains fixes
RU: Release Update: contains both new features and fixes
RUR: Release Update Revision: contains security and regression fixes only
Remember that since the advent of 12c, we have BPs and PSUs and we must choose one route or the other (don't mix BPUs with PSUs!)? Well, that's outdated. Since 12cR2 we have RUs and RURs.
Read this article from Mike Dietrich (Database Ugrade Product Manager at Oracle) for an explanation on RUs ad RURs but here's a picture from it:
And to top it all, there are exceptions on Exadata:
You cannot apply a PSU on a 126.96.36.199 Exadata database.
Also keep in mind that for RAC, you must install 2 patches: one for the GRID_HOMEs and one for the ORACLE_HOME.
I asked Oracle and even though it possible to patch only the ORACLE_HOME (and thus have a GRID_HOME in a lower version), it is not recommended.
To sum it up: