Six major Linux distributions shipped security updates today, with the same X11 library bugs recurring across SUSE, Oracle, and Red Hat advisories. Debian's Firefox ESR picked up a massive 145 CVEs alongside Chromium (52) and OpenJDK 25 (40), all covered by a single apt upgrade. Red Hat flagged eight Critical items led by a certificate trust-stack bug on RHEL 6 ELS and four OpenShift platform releases that need real attention. Meanwhile SUSE's curl update closes 23 CVEs with DPDK topping 8.0, and AlmaLinux packed 16 kernel fixes into one advisory.

A 145-CVE Firefox and a coordinated X11 cleanup: today's Linux security wave

Six major distributions shipped patches today. Most of it is the usual churn. A few things need your attention before you close your laptop.

Today's round of Linux security updates leans more on repetition than on a single bombshell. The same X11 library bugs show up across three separate vendors' advisories, Firefox shipped a 145-CVE advisory on Debian, and Red Hat is pointing us straight at a certificate trust-stack bug that tends to bite in the real world.

The six-way roundup covers AlmaLinux, Debian, Fedora, Oracle Linux, Red Hat Enterprise Linux, and SUSE. Most of it is the memory-safety churn you'd spot in any given day's batch. A handful, though, are the kind you should handle before you shut down for the day.

The same bugs, three vendors deep

If you're patching anything from this feed, the X11 libraries are the ones that keep showing up.

libXrender takes a heap overflow that lets code run through RenderQueryPictFormats. libX11 ships the same kind of overflow, though only a malicious X server can trip it. libXi and libXtst are mostly denial-of-service gremlins drawn from out-of-bounds reads.

SUSE, Oracle, and Red Hat all moved these exact packages on nearly the same day. That's not a coincidence. It's a coordinated vendor cleanup, the kind nobody pays attention to until one broken dependency snags a running app.

Keep in mind that the X11 mess isn't the only headline today. Debian is where the biggest numbers live.

Firefox ships a 145-item CVE list

Mozilla shipped 145 distinct CVEs in a single Firefox ESR advisory. For one browser update, that's a lot, which usually means a pile of fuzzing finds mixed in with a couple of genuine problems. Chromium followed with 52 of its own, mostly arbitrary code execution and information disclosure. OpenJDK 25 rounded things out with 40, including sandbox breakout and incomplete certificate checks.

Everything ships as deb13u1 for stable, so a single sudo apt upgrade covers all three. Prioritize the browser.

On Red Hat's side, the question is less what shipped and more what you should act on. Red Hat circulated eight Critical advisories this cycle, and a couple aren't the kind you schedule for next quarter. The sharpest edge sits on the certificate and trust stack: ca-certificates and nss on the red-line RHEL 6 Extended Lifecycle Support extension. Bugs in that area bite in practice, so handle it before you get comfortable.

Then there's OpenShift. Four platform releases show up as Critical: 4.22.20, 4.21.40, 4.20.44, and 4.19.53. The 4.22.20 update is split across two errata, one Critical and one Important, so don't stop reading at the first one. With that many clusters running, budget real time for them.

Fedora's best work landed on unbound, which jumped straight to 1.26.2 and closed five distinct CVEs at once. Packing five CVEs into a single release is a fair amount of damage, and recursive DNS operators should treat it as an immediate job rather than a "when I get to it" item. Memory-safety problems make up most of the rest. librabbitmq gained a heap buffer over-read triggered by an unusual content header class id, and OSS-Fuzz caught it before any human did.

Firefox is the lone entry without a security tag, a routine bump to 159.0 with one wrinkle. The build deliberately abandoned s390x because it would not compile, so on that architecture you'll stay on the previous Firefox until upstream sorts it out.

SUSE is the rolling-release special. openSUSE Tumbleweed shipped a large pile of mostly-moderate ratings with no single headline exploit, the kind you sort of accept. curl took the biggest haul at 23 CVEs, which sounds alarming but is really standard curl hygiene. A few let an attacker hijack a session or leak credentials through redirects, so make that one a priority if your scripts follow redirects. DPDK is the entry that actually earns the attention, with 14 vulnerabilities and most sitting above 8.0. Data-plane apps built on DPDK are the ones that need it. Don't sleep on this one.

Back at AlmaLinux, the round shipped October 28 and the kernel is where the weight sits. A single advisory swallowed 16 security fixes plus a couple of bug fixes, covering use-after-free bugs in USB and iSCSI handling up through a socket filter that used to let unprivileged users reach into territory they shouldn't. If you only fix one thing from this batch, make it the kernel. Emacs rounds out the feed with an arbitrary code-execution bug that fires the moment you open a file.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux shipped a round of security errata on October 28, and the kernel is where the weight is. A single kernel advisory swallowed 16 security fixes plus a couple of bug fixes and enhancements, covering everything from use-after-free bugs in USB and iSCSI handling to a socket filter that previously let unprivileged users reach into territory they shouldn't. If you only fix one thing from this batch, make it the kernel.

The rest reads like a standard X11-family cleanup. Emacs gets patched for an arbitrary code-execution bug that fires when you open a file. Several X libraries follow the same recipe: libX11 takes a heap overflow from a malicious X server, libXtst and libXi offer denial-of-service gremlins through out-of-bounds reads, and libXrender is the one that actually lets code run via a heap overflow in RenderQueryPictFormats, so it deserves the most attention. WebKit shows up too, but only on the older AlmaLinux 8, with six separate ANGLE issues folded into one webkit2gtk3 advisory. Six CVEs for one component sounds alarming, but it's the usual memory-safety cluster you'd expect from a GPU-facing graphics stack.

A good chunk of this feed is just older news that's already been dealt with. The ZDI-CAN-33367 kernel fix now rides along with the regular updates across all three current releases, so a plain dnf upgrade and a reboot covers it. The CIFSwitch patch went to production back in June. The four 2025 entries (libblockdev, open-vm-tools, FreeType, OpenSSH) started as "call for testing" notices and have since graduated to the stable repos. Nothing here needs you to enable any testing repository.

The active work is the October batch. Get the kernel and Emacs updates in first, then clear through the X11 libraries.

Debian GNU/Linux

Debian rolled three security fixes into the trixie stable repo this week. Chromium, Firefox ESR and OpenJDK 25 all picked up CVE patches dated October 28, and two of these make you want to run sudo apt upgrade before you finish reading the headline.

Firefox is the one to flag. Mozilla shipped 145 separate CVEs in this advisory, spanning arbitrary code execution, sandbox escape, same-origin policy bypass, privilege escalation, information disclosure and spoofing. That's a big number for a single browser update, which usually means a pile of fuzzing finds mixed in with a couple of genuine problems. Chromium trails with 52 CVEs of its own, mostly pointing at arbitrary code execution, denial of service and information disclosure. OpenJDK 25 rounds things out with 40 CVEs for the Java runtime, denial-of-service and sandbox-breakout issues sitting alongside some incomplete certificate checks.

Everything ships as deb13u1 for stable, so one upgrade covers all three. Prioritize the browser.

Fedora Linux

Fedora shipped a batch of security updates on October 29, with the bulk landing on version 44 and a single package trickling all the way down to 43. The most impressive one is unbound, which took a single jump to 1.26.2 and managed to close five distinct CVEs in the process. That is a fair amount of damage to squash into one release, but recursive DNS operators are likely treating this as an immediate job rather than a "when I get to it" item.

Memory-safety problems make up most of the pile. librabbitmq gets a heap buffer over-read patched, triggered when it processes a content header frame carrying an unusual class id, and for once OSS-Fuzz found it before any human did. LibreSwan, the Linux IPsec stack, absorbed a cluster of null-pointer dereferences plus a use-after-free hiding in the IKE-over-TCP path. Pillow backported a denial-of-service fix for its MSP image decoder, which is a heads-up for anyone compositing images.

Firefox is the only entry without a security tag, and it's a routine bump to 159.0. The one wrinkle: the build deliberately abandoned s390x because it would not compile. If you run that architecture, you stay on the previous Firefox until upstream sorts it out.

Oracle Linux

Oracle Linux pushed a fresh batch of security advisories across three OS versions. If you run OL8, OL9, or OL10, a solid chunk of this lands on boxes you actually use.

The OL10 story is basically the X toolkit getting attention in a single night. libX11 closes a heap-based buffer overflow a malicious X server can trigger, libXrender takes a code-injection heap overflow in RenderQueryPictFormats, and libXi bundles three CVEs into one bump. libXtst rounds out the group with a denial-of-service through an out-of-bounds read. These are exactly the dependency patches nobody notices until one breaks, which is why you want them installed.

OL9 gets the heavier hits. The kernel (ELSA-2026-90365) covers 15 CVEs spread across CIFS, FUSE, netfilter, keys, KVM and a few others. buildah and podman both get rebuilt on a newer golang plus CVE fixes, and cjose closes a heap overflow in AES key unwrap.

OL8's headline move is LibreOffice. Oracle rebased it from 6.x to the 7.x line mainly to escape OpenJDK 8, since RHEL 8 stops supporting JDK 8 in November 2026. The same advisory absorbs four LibreOffice CVEs (heap and stack overflows, plus arbitrary code execution through a Java database driver). Thunderbird gets pushed to the 140.17.0 ESR with 40-plus related CVEs, python-urllib3 gets a DoS fix, and emacs picks up Flymake-related hardening.

Two more OL8 kernel advisories round out the batch. ELSA-2026-87375 and ELSA-2026-85773 are near-identical sequential bumps, heavy on gfs2 refactor churn alongside real CVEs in xfrm, sctp, and netfilter. If you aren't running gfs2, most of that churn is just noise for you. The kernel and Thunderbird advisories deserve top priority on anything that uses them, then clear through the X11 bumps.

Red Hat Enterprise Linux

Red Hat circulated another batch of errata this cycle, and if you only act on one thing from the pile, make it the eight Critical items. A couple of them aren't the kind you schedule for next quarter.

The sharpest edge is on the certificate and trust stack: ca-certificates and nss for the red-line RHEL 6 Extended Lifecycle Support extension. Bugs in that area tend to bite in practice, so handle it before you get comfortable. Two JDK-family updates also land at Critical, the portable Linux build of OpenJDK 17.0.21 and a .NET 9.0 hit on RHEL 9.6 ES. Browser-side, webkitgtk4 gets a Critical rating, though it's riding on RHEL 7's Extended Lifecycle Support, which means fewer places still run it.

The OpenShift cluster deserves a slot in your week. Four platform releases show up as Critical: 4.22.20, 4.21.40, 4.20.44, and 4.19.53. The 4.22.20 release is split across two errata, one Critical and one rated Important, so don't stop reading at the first one. If you run more than a couple of clusters, budget real time for these.

Everything else mostly sits at Important. You'll find the kernel updates here, including a security-plus-bugfix-plus-enhancement run for RHEL 10.2 ES, along with a pile of X11 libraries (libXtst, libXi, libXrender), brotli, and ordinary suspects like thunderbird, python-urllib3, and python-tornado. Much of it is scoped to specific channels - SAP Solutions, Extended Update Support, Advanced Mission Critical - so a lot of it won't touch your box unless you actually run those tracks.

There's also a handful of non-security release notices tagged Important for their security content: the JBoss EAP 8.1.9 trio across RHEL 8, 9, and 10, plus the Quarkus 3.27.6.SP1 and Apache Camel 3.33.4.SP1 releases, go-toolset, pki-deps, and the Service Interconnect 2.2.4 RPMs. These are really just version bumps wearing a security jacket.

One thing to flag. RHSA-2026:92057 for JBoss on RHEL 8 skips Red Hat's usual severity line in the description, so you can't read the rating off the blurb alone for that one.

SUSE Linux

openSUSE Tumbleweed is getting a large pile of security updates this round, and nearly all of them carry a "moderate" rating across a dozen unrelated packages. There's no single headline exploit here, just the rolling-release churn you sort of accept.

The biggest haul goes to curl. That update kills 23 CVEs, which sounds alarming but is really standard curl hygiene. A few let an attacker hijack a session or leak credentials through redirects and malformed URLs, and a handful land in the seven-to-nine CVSS range. If your scripts follow redirects, make this one a priority.

Chromedriver is next with 37 fixes packed into version 155.0.8059.39, and it drags chromium along for the ride. SUSE didn't break out individual CVSS scores here, so you're left to assume it's a broad sweep across a family of issues rather than one nasty zero-day.

DPDK is another meaty one at 14 vulnerabilities, and most of those sit above 8.0, with a couple topping nine. If you're building data-plane apps on top of DPDK, don't sleep on this one.

The remainder are smaller and less exciting. nginx took five CVEs, three of them near the top of the scale, so keep the servers patched. openai-codex got three nearly identical fixes all rated 7.5. Alsa, libzbar, coredns, libpoppler, and libsndfile round out the batch with a handful each, mostly low-to-moderate scores where the main point is just closing the door.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y