Debian and Freexian released a wave of advisories topped by unbound's 30 CVEs and a 6.12 kernel patch for bookworm, while Chromium's LTS build ballooned to nearly 300 fixes. Fedora 43 and 44 shipped updates headlined by doctl's nine CVEs plus GIMP, FreeIPA, and opkssh fixes. Red Hat pushed a sprawling 32-advisory RHSA-2026 batch covering kernel, openssh, and rust, though several packages sit on niche channels. SUSE closed the roundup with a 153-vulnerability kernel-devel package and important libsoup fixes aimed at older SUSE Linux Enterprise systems.

This week's Linux security roundup brings a 153-vulnerability kernel and a 30-CVE DNS resolver

The distro security teams have been busy, and this week's patch batch is one you don't want to skim. Debian and Freexian dropped a pile of advisories reaching from a DNS resolver to the Linux kernel, Fedora shipped fixes for 43 and 44, Red Hat pushed a sprawling 32-advisory errata, and SUSE quietly landed a kernel-devel package carrying a rather staggering 153 vulnerabilities. If you run any of the affected packages, the message is identical everywhere: upgrade now.

The advisory that makes you stop is unbound. Thirty CVEs landed in a single release covering denial of service, cache poisoning, DNS cookie bypass, and potentially arbitrary code execution. Thirty in one package is a lot for a DNS resolver you probably never think about, but that's exactly the kind of thing that keeps sysadmins awake.

Chromium shows up twice. The stable branch picked up 16 CVEs while the bookworm-through-LTS build balloons to nearly 300. If you use Chromium, patch the LTS version first, since it already covers the stable issues.

The Linux kernel update for bookworm is its own saga. Debian LTS is bringing the 6.12 kernel onto old stable, bundling fixes from builds 6.12.102 through 6.12.107 plus new Alcor card reader drivers. Privilege escalation, denial of service, and information leaks round out the tally.

GIMP's flaws live entirely in file parsing, so the advice is practical: avoid untrusted PSD, ICO, PIX, or PCX files, and steer clear of sketchy light-effects filters. That same HDR parsing problem also shows up in GIMP 3.2.6 and gegl04 0.4.72 on Fedora, both fixed for an integer overflow upstream flagged as a remote code execution risk. doctl, the DigitalOcean CLI, is Fedora's headline with nine CVEs riding in bundled libraries spanning Moby, containerd, BuildKit, golang.org/x/crypto/ssh, and OpenTelemetry-Go. It's basically a thin wrapper around the DigitalOcean API, so nine CVEs is busier than the tool really needs. FreeIPA got a straight security release for two CVEs, and Thunderbird 155.0 is the odd one in, carrying a security tag but only "update to the latest stable version" with no specific CVE. opkssh bumped its bundled crypto for two DoS CVEs, though maintainers note the vulnerable code is never actually reachable since opkssh only uses SSH for key handling.

Red Hat and SUSE

Red Hat pushed another big batch under the RHSA-2026 umbrella, this one with 32 advisories across the Enterprise Linux family. Most land at "Important," a handful at Moderate, and exactly one slips through at Low. Kernel, openssh, and rust got the treatment, alongside tesseract and libtiff. libtiff is the usual reason people patch, and openssh is the reason people patch on a schedule.

Keep in mind these aren't all clean yum update jobs. A chunk only lands on niche channels like SAP Solutions, Telecommunications, and the Extended/Mission Critical add-ons, so you might not find them in a standard repo. libtiff and rust each hit multiple branches separately, so a single update won't cover every system. The errata titles are sloppy too: RHSA-2026:69131 for virt:rhel is headlined "Important" yet Red Hat rated it Low. Trust the CVSS number, not the headline.

SUSE's batch is a familiar spread. The kernel-devel patch is where the volume lives: 153 vulnerabilities in one package. Most sit in the moderate band, but a handful top 8.5 on the CVSS 4.0 scale, with CVE-2026-89482 reaching 9.2. If you build anything against the kernel sources, this is the one you'll want.

The alloy update took more hits than a shell usually does, with 18 CVEs clustering near 8.6. Since alloy is SUSE's Rust-based shell, Tumbleweed users feel the direct hit. The libsoup fixes are the only ones marked important, and they skip Tumbleweed entirely, landing on SLES 15 SP4 through SP7 plus HPC and SAP editions. A heap use-after-free trips during an HTTP/2 body upload, and a heap buffer overflow from a crafted SETTINGS frame scores 9.2. If you run anything leaning on older SLES, grab it.

An Overview of the Updates

Debian GNU/Linux

Debian and Freexian dropped a batch of security advisories, touching everything from a DNS resolver to the Linux kernel. If you run any of these packages, the message is uniform: upgrade now.

The one that makes you stop is the Linux kernel update for bookworm. Debian LTS is carrying the 6.12 kernel onto an old stable release and bundling it with fixes spanning intermediate releases 6.12.102 through 6.12.107, plus new drivers for Alcor card readers. That is a lot to retrofit onto an EOL-adjacent distro, but it is exactly the kind of patch you'd want if you are still sitting on bookworm. Privilege escalation, denial of service, and information leaks round out a pretty terrible tally of issues for one build.

Unbound is the number-cruncher here, with 30 CVEs covering denial of service, cache poisoning, DNS cookie bypass, and potentially arbitrary code execution. Thirty in a single release is a lot for a DNS resolver you probably never think about. Chromium also shows up twice, once for stable (16 CVEs) and once for bookworm through LTS, where the list balloons to nearly 300. If you use Chromium, patch the LTS version first, since it already covers the stable ones.

GIMP's flaws live entirely in file parsing, so the practical advice is straightforward: avoid opening untrusted PSD, ICO, PIX, or PCX files, and steer clear of sketchy light-effects filters. libarchive and libde265 get patched through Freexian's extended LTS program. libde265 is the H.265 decoder you install and forget, which is precisely why its stack of buffer overflows matters. Note that both libde265 advisories include fixes without assigned CVE IDs, meaning the code was corrected before the paperwork caught up.

Fedora Linux

Fedora pushed a batch of security updates for Fedora 43 and 44 on September 20–21, 2026. Most plug genuine holes; a couple are more about staying compatible with new dependencies.

The biggest headline is doctl, the DigitalOcean CLI. Version 1.169.0 packs nine CVEs into a single update, spanning the Moby container framework, golang.org/x/crypto/ssh, OpenTelemetry-Go, BuildKit, and containerd. doctl is basically a thin wrapper around the DigitalOcean API, so nine CVEs riding in its bundled libraries is a busier patch than the tool really calls for.

The HDR parsing bug lands in two packages. GIMP 3.2.6 and gegl04 0.4.72 both get fixes for an integer overflow when parsing RGBE/HDR files, which upstream flagged as a remote code execution risk. If you open sketchy image files, this is the one to bother about.

libheif 1.23.4-6 on Fedora 44 handles the rest of the image side, splitting the FFmpeg plugin into its own optional subpackage to trim the main package's footprint and getting rebuilt against FFmpeg 9.

FreeIPA 4.13.4-1.2 is a straight security release for Fedora 44, closing CVE-2026-79678 and CVE-2026-76578, plus a bit of privilege-check and cross-forest trust hardening.

The opkssh updates show up on both Fedora 43 and 44, bumping the bundled golang.org/x/crypto to 0.56.0 to address two denial-of-service CVEs. Worth knowing the maintainers flag that the vulnerable code is never actually reachable, since opkssh only uses SSH for key handling.

Thunderbird 155.0 is the odd one in the batch. It carries a security advisory tag but the note is just "update to the latest stable version," with no specific CVE attached.

Red Hat Enterprise Linux

Red Hat pushed another large batch of security errata, this one carried under the RHSA-2026 umbrella with 32 advisories spread across the Enterprise Linux family. Most land at "Important" on Red Hat's own scale, a handful settle at Moderate, and exactly one slips through at Low.

If you run anything in production, a few names will grab you immediately: the kernel, openssh, and rust all got the security treatment, alongside the tesseract OCR library and the libtiff image handler. libtiff is the usual reason people patch, and openssh is the reason people patch on a schedule.

A couple of things worth knowing before you start running updates. First, these aren't all clean yum update jobs. A chunk only lands on the niche channels, so you might not find them sitting in your standard repo: SAP Solutions, Telecommunications, and the Extended/Mission Critical and Extended Lifecycle add-ons. libtiff and rust each hit multiple branches separately instead of as one tidy bump, so a single update won't cover every system you own.

The errata titles are a little sloppy too. RHSA-2026:69131 for the virt:rhel module is headlined "Important," yet Red Hat actually rated it Low. The headline severity and the CVSS rating disagree, so trust the number in the table.

SUSE Linux

SUSE shipped another round of security fixes, and the spread is familiar. Five announcements hit openSUSE Tumbleweed and all read moderate, while two libsoup updates climb to important for older SUSE Linux Enterprise boxes.

The kernel-devel patch is where the volume lives: 153 vulnerabilities inside one package. Most sit in the moderate band, but a handful top 8.5 on the CVSS 4.0 scale, with CVE-2026-89482 reaching 9.2. If you build anything against the kernel sources, this is the one you will want.

The alloy update took more hits than a shell usually does, with 18 CVEs spread across its components and scores clustering near 8.6. Since alloy is SUSE's Rust-based shell, Tumbleweed users feel the direct hit here.

nginx and NetworkManager's L2TP applet stayed quiet, picking up one and two CVEs respectively. Both moderate, so apply them but do not lose sleep.

The libsoup fixes are the only ones marked important, and they skip Tumbleweed entirely. They land on SUSE Linux Enterprise 15 SP4 through SP7, plus the HPC and SAP editions. Two flaws: a heap use-after-free that trips during an HTTP/2 body upload, and a heap buffer overflow from a crafted SETTINGS frame that scores 9.2. If you run anything leaning on older SLES, grab it.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y