Red Hat led today's roundup with 180 advisories across RHEL 7 through 10, though the 131 Important ratings reflect broad channel coverage more than that many distinct flaws. The standout threat is a pre-boot RCE in the edk2 PXE driver (CVE-2026-97631), tagged Critical on AlmaLinux, Oracle, and Rocky Linux 10. Pillow drew the biggest single library hit with 39 CVEs on SUSE plus three Criticals on RHEL, while a recurring AMD SEV-SNP hole keeps getting re-published under fresh Ubuntu kernel releases. If you run RHEL 9 or 10, nearly everything applies in one pass, and Ubuntu is still patching its 2014-era 14.04 LTS release.

Linux security roundup: a pre-boot RCE, 180 Red Hat advisories, and a lot of Pillow

A pre-boot remote code execution is hiding in your firmware. Red Hat just dropped 180 advisories in a single pass. And Ubuntu is still patching 14.04, the release that predates most of the people reading this. Today's Linux security updates add up to a genuinely large pile, and only some of it will keep a stranger out of your box.

The edk2 update is the lone Critical rating showing up in more than one place. CVE-2026-97631 is a pre-boot RCE in the PXE driver, meaning an attacker can reach you before your OS even finishes loading. It lands on AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10, all in the same advisory slot. It mostly bites machines doing network boot for virtual machines, but pre-boot RCE is pre-boot RCE.

Pillow is the other recurring headline. SUSE handed out 39 CVEs for the Python image library in a single sweep. Red Hat rated it Critical three times in one pass, once each for the RHEL 8.4, 8.6, and 8.8 tracks. Pillow quietly runs under a lot of Python tooling, so it tends to land somewhere you actually care about.

Then there's the AMD SEV-SNP issue. CVE-2023-20585 is old, yet Ubuntu keeps re-publishing it under fresh kernel releases for AMD-based guests. The mechanism never changes. An attacker with hypervisor access just trips an out-of-bounds read against confidential-guest memory. Reboot clears it if you run anything on the AMD cloud.

It's arguably competing with the browser ESR batches for raw CVE volume. Oracle Linux ships Thunderbird 153.6.0 ESR with what reads as well into the hundreds of CVEs, and Firefox 153.6.0 on OL 10 tops 150. Mozilla batches ESR fixes and calls it discipline. You'd have to be a glutton to count them all.

A quieter cross-distro detail: the same Brotli decoder flaw shows up in both Gentoo's advisory and Ubuntu's Node 24 update earlier this week. One CVE, several distros, nobody talking to each other.

What to patch first

RHEL is the entry that actually makes you open a spreadsheet. Red Hat's run totals 180 advisories spanning RHEL 7 through 10, a couple of specialized channels, and one stray Oracle Linux entry. Severity skews toward Important: 131 land there, 37 are Moderate, 10 Critical, and 2 Low. But the "131 Important" figure is as much about coverage as about distinct flaws. Packages like urllib3, firefox, and kernel get fanned out across EUS, SAP, Telecommunications, and Extended Lifecycle variants. Several rows on the list is usually the same problem, just re-tagged for a different support channel.

If you run RHEL 9 or 10, nearly everything here applies and you can knock it out in one pass. The rarer platforms bring their own subset, so keep the version matrix current before you call the patch window closed.

Fedora ran a long queue on November 11 across versions 43, 44, and 45. Most of it is version bumps, but two entries are the ones to clock. TigerVNC got rebuilt on a patched X server to shut down eight CVEs, several flagged as arbitrary code execution, so if you reach a desktop over VNC that one is not optional. .NET 11.0's release-candidate bump lands 41 fixed CVEs in a single update. They're really the same family of runtime issues at heart, which is a nice way of saying one patch does the job.

Ubuntu's own batch is dominated by the kernel, as always, but it carries the most honest notice in the pile. The Tornado follow-up (USN-8952-3) walks back a prior fix that broke static file serving for Jupyter-style apps because it got too paranoid about symlinks into /usr/share. The vendor admits the earlier fix made things worse. You rarely get a company doing that, so it earns a little credit.

Chase the edk2 pre-boot RCE and the RHEL Pillow Criticals first. Then sweep the image libraries, since those are the ones most likely to trigger off an inbound file. Debian alone pulled 32 CVEs for ImageMagick and 26 for OpenEXR this week, both libraries that chew on untrusted image data. If you process HDR imagery, take the OpenEXR 3.2.12 upgrade.

The Node.js sprawl is worth doing while the updates overlap, because a single sweep tends to cover most of your JavaScript surface at once. And don't skip the legacy buckets. Ubuntu is still shipping kernel fixes for 14.04, one of which closed a 2017 Turtle Beach audio driver hole. A quiet reminder that old code never really retires.

A Detailed Overview

AlmaLinux

AlmaLinux pushed a batch of 12 security advisories across three major versions, and if you operate anything on AlmaLinux 8, 9, or 10, this is worth a look before you lean back and trust auto-updates to have you covered. The releases landed between November 9 and 10, 2026, and the severity peak is a Critical rating on the edk2 firmware package. That one carries a pre-boot remote code execution in its PXE driver, the sort of hole that reaches you before your operating system even finishes booting. It mostly bites machines doing network boot for virtual machines, but pre-boot RCE is pre-boot RCE.

The kernels carry most of the weight. The AlmaLinux 9 kernel pull brings in 19 security fixes ranging from SCTP stream handling to a seccomp bypass that survives a ptrace with TSYNC, plus one Zeroday Initiative advisory (ZDI-CAN-33367) that arrives with no CVE number at all. The AlmaLinux 10 kernel is leaner at 16 CVEs but repeats much of the 9 kernel set, since the two share the same upstream code patched in lockstep.

Then comes the Node.js sprawl. Four different advisories touch JavaScript tooling: nodejs:22 on AlmaLinux 9, and nodejs22, nodejs24, and nodemon all on AlmaLinux 10. They hand-share the same brace-expansion denial of service bugs (uncontrolled recursion and stack exhaustion out of nested braces) alongside a block of undici issues covering TLS certificate validation bypasses, renegotiation-based DoS, and cache poisoning. Node 24 adds one extra hostname-bypass hole involving fullwidth digits. You could almost set a clock to how often CVE-2026-102278 and CVE-2026-102276 reappear, but there is a silver lining: one update sweeps most of your JavaScript surface at once.

On the milder end, glibc on AlmaLinux 8 takes a moderate hit, with a dynamic loader TOCTOU race that can escalate privileges and run code, a stack overflow in nscd that throttles DNS resolution, and a couple more buffer overflows. The patch utility earns a moderate rating for a filename-validation bypass that lets it drop files outside your working directory, while Ruby on AlmaLinux 10 collects four regular-expression bugs (double frees and integer overflows) on its way to a 3.3 rebase. Tomcat rounds out the important tier with five authorization bypasses and an HTTP/2 resource leak. The practical upshot: chase the edk2 RCE and the glibc loader race first, then knock out the rest while the Node.js overlap still makes the JS sweep painless.

Debian GNU/Linux

Debian and its LTS arm shipped four security advisories, and the story here is less about how severe each one is and more about the sheer volume piled onto image-processing code. The two standouts are imagemagick and openexr, both libraries that chew on untrusted image data, which is exactly where you want the guards bolted up.

The imagemagick fix (ELA-1883-1, routed through Freexian's Ubuntu LTS channel for the old bullseye release) closes 32 vulnerabilities. Malformed images can trigger denial of service, policy bypasses, information disclosure, and in the worst case arbitrary code execution. That is a big number for a single release, though imagemagick has been under close watch for years, so a wide net like this comes as little surprise.

openexr follows a similar script with 26 CVEs. It handles high dynamic range images, and malformed files here cause denial of service or out-of-bounds memory reads and writes. Debian dealt with it by moving to the OpenEXR 3.2 series while keeping the trixie ABI intact, shipping the fix in 3.2.12-1~deb13u1. If you process HDR imagery, that upgrade is the one to take.

srt and rsyslog bring the count down but not the annoyance. srt is a latency-aware UDP library for live video over the Secure Reliable Transport protocol, and two CVEs let an attacker who can reach an SRT socket crash the process, plus force an encrypted receiver to accept plaintext packets so a live stream can be swapped or cut. rsyslog collects four CVEs across its imptcp, mmpstrucdata, and RainerScript code paths, all reachable by unauthenticated remote senders. You get crashes and, in two of the four, stack or heap overwrites that put control of the logging daemon in a stranger's hands. Both sit in the Debian 12 bookworm LTS point releases.

Practical reading: patch the image libraries first, since those are the most likely to be hit by random inbound files. The srt and rsyslog fixes target a narrower set of services, but a remote stranger taking down a logging daemon or a live video feed is its own kind of problem.

Fedora Linux

Fedora pushed a long queue of security advisories on November 11th, fanned out across Fedora 43, 44, and 45. If you run any of those three, something is waiting to be updated. Most of the batch is the expected version bumps and rebuilds, but several of them actually close holes that let attackers run code or climb to root privileges.

The loudest quiet move is in the Rust world. A dozen packages got rebuilt against webpki-roots 1.0.11, which trims the emSign Root CA (C1/C3) from the trust list. That chain kept showing up in certificate headaches, so cutting it is the unglamorous but worthwhile kind of maintenance. The packages caught in that sweep include ingredients, rbw, sequoia-sq, siguldry-fedora-autopen, and pore.

Then there's mstflint, the Mellanox firmware-burning tool. Upstream used to validate TLS connections against a private copy of Mozilla's root store that hadn't changed since July 2021, meaning it still trusted roots that later got distrusted, including the eMudhra intermediate CA that got compromised. It now defers to your system's trust store instead. You probably won't notice, until the thing that needed noticing stops working.

The two entries with the biggest numbers are TigerVNC and .NET. TigerVNC got rebuilt against a patched xorg-x11-server to shut down eight vulnerabilities, several of them flagged as arbitrary code execution, so if you reach a desktop over VNC, that one isn't optional. .NET 11.0's release-candidate bump lands 41 fixed CVEs in a single update. That's a lot of CVE numbers, but they're really the same family of runtime issues at heart.

The rest fill in the gaps: alertmanager climbs to 0.34.2 and closes five distinct issues (crypto/x509 denial of service, an SSH agent key-confirmation bypass, an OpenTelemetry DoS, an AWS SDK DoS, and a Prometheus information-disclosure via HTTP redirects), NextCloud hits 35.0.2 and plugs a KaTeX cross-site scripting hole, unbound reaches 1.26.2 with five DNSSEC fixes, GDAL on Fedora 44 backports a NetCDF buffer-overflow patch, zchunk gets a memory-correctness update, and pulldown-cmark fixes two parsing blow-ups triggered by the off-by-default wikilinks option.

Gentoo Linux

Gentoo's security team filed three High-severity advisories across two days, and two of them promise to let an attacker run code on your machine. All landed November 10th and 11th, so if you've run emerge --sync since then you've already moved, and if you haven't you're the one behind.

The heaviest is libde265, the open h.265 (HEVC) video decoder. Twelve CVEs tie to it, spanning bugs reported in both 2023 and this year, plus a dozen GitHub security advisories. Anything before 1.1.3 is exposed, and the worst outcome is arbitrary code execution. If you watch modern video at all you almost certainly link against this already, and Gentoo hands you no workaround, which just means upgrade is the only play.

git picks up six CVEs in its own advisory. It's the one thing nearly everyone on the developer end reaches for, so the blast radius is broad regardless of what the individual findings actually do. Six problems, worst case arbitrary code execution, and again no workaround, so pin yourself to 2.56.1 or newer.

Brotli is the thin one: a single lossless-compression flaw, CVE-2026-111497, that also happens to be the same CVE that bit .NET's runtime update from earlier this week. Under 1.2.0-r2 is vulnerable, and the headline is remote code execution. Same shape as the rest, so bump it and move on.

Oracle Linux

Oracle just ran its January security cycle across Oracle Linux 7 through 10, and the pile of advisories is as usual. Some of these you'll actually act on. Others are the kind of thing that quietly stops being urgent the moment you reboot.

The headline grabber is the Oracle Linux 10 edk2 update, the only thing in this batch Oracle took the trouble to tag Critical. CVE-2026-97631 is a pre-boot remote code execution in the PXE driver, which is the specific flavor of RCE you'd rather not have. The fix is mostly rebranding churn stacked on top of an upstream patch, though pre-boot RCE earns the Critical tag on its own merits.

Browser fans get the usual ESR batching. Oracle Linux 7 ships Firefox 140.15.0 ESR with a tidy dozen new CVEs, but the description actually walks back through a pile of older ESR branches (140.8.0 all the way up to 140.15.0), so the patch covers more ground than the "related CVEs" list lets on. Oracle Linux 9 and 10 both get Thunderbird 153.6.0 ESR with a staggering count of CVEs running well into the hundreds. That's ESR discipline working as intended, though you'd have to be a glutton to count them all. Node.js keeps its usual spread: Node 24 on Linux 9, Node 22 on Linux 10, and a nodemon-only update on Linux 10, all patched for the same batch of DoS-flavored library issues.

The kernel updates are where the real volume lives. Unbreakable Enterprise Kernel revisions land for the 5.4, 5.15, and 6.12 lines across Linux 8, 9, and 10, with the Zen5 TSA microcode fixes and an AMD iommu device-table workaround turning up repeatedly. A lot of these are the same advisories split across architectures, so don't confuse several rows for several separate problems. The 5.15.224 change in particular carries a changelog long enough to make you appreciate the simple virtue of just running yum update.

On the quieter side, Linux 8 gets a glibc forward-port that resolves a handful of DoS and privilege-escalation CVEs (the $ORIGIN handling ones are the only ones worth an actual restart), a patch-only update for a filename-validation bypass, and a DPDK update clearing out fourteen CVEs for anyone running data-plane workloads. Ruby 3.3.13 and Ruby 4.0.9 on Linux 10 pick up integer-overflow and double-free fixes in the regex engine.

Most of this arrives through the standard update path. If you're still on Linux 7 running an older Firefox, jump on 140.15.0 first. The critical edk2 fix is Linux 10 only, so nobody on the older releases needs to lose sleep over it.

Red Hat Enterprise Linux

Red Hat shipped another wide batch of errata, and if you track vulnerabilities for a living, you now have a full spreadsheet today. The run totals 180 advisories spanning RHEL 7 through 10, a couple of specialized channels, and one stray Oracle Linux entry. Severity skews squarely toward Important: 131 land there, 37 are Moderate, 10 Critical, and 2 Low.

The Critical cluster is the part that actually moves the needle. Red Hat rated python-pillow Critical three times in one pass, once each for the RHEL 8.4, 8.6, and 8.8 maintenance tracks, so if any Python web workload touches your estate, that's your first patch. Two OpenShift releases (4.17.60 and 4.13.73) also took the Critical bug-fix treatment, as did webkitgtk4 on the dying RHEL 7 line. cjose, fence-agents, cockpit-image-builder, and a Critical python-tornado update fill out the rest. The advisories point at CVE links but don't spell out the numbers, so treat the Critical label as Red Hat's assessment, not a detailed breakdown.

What's more interesting than any single bug is the pattern. Packages like python-urllib3, firefox, kernel, xorg-x11-server, grafana, and skopeo get fanned out across EUS, SAP Solutions, Telecommunications, and Extended Lifecycle Support variants. That's normal for an org this size, but it means the "131 Important" figure is as much about coverage as about distinct flaws.

The Oracle Linux entry, ELSA-2026-93956, covers firefox 153.6.0 on OL10 and lists well over a hundred CVEs, running from CVE-2026-117860 to CVE-2026-118004. Mozilla batches ESR fixes and this is one of those mass-patch days. Red Hat's own firefox advisories across the set carry the same shape.

If you run RHEL 9 or 10, nearly everything here applies and you can cover it in one pass. The rarer platforms (RHEL 7 ELS, the EUS and SAP channels, plus OCP) each bring their own subset, which is just a nudge to keep your version matrix current before you call the patch window closed.

Rocky Linux

Rocky Linux shipped a batch of errata spanning all three of its current releases, and the footprint is wider than the content suggests. Read closely and most of it is routine security patching, but a couple of details are worth a second look.

The lone Critical entry on the list is edk2 on Rocky Linux 10, which is rarer than you'd expect from a routine drop. Everything else tops out at Important, with ruby and a handful of utilities parked at Moderate. Node.js and Ruby show up repeatedly, and postgresql:16 appears twice, so if you're auditing against CVE lists, don't double-apply it.

Slackware Linux

Slackware pushed a security rebuild for xorg-server (SSA:2026-314-01) at Slackware 15.0 and -current. The core package fixes six memory-safety holes; the xephyr, xnest, xvfb, and xwayland sub-packages get the same fixes minus the EDID range check. xwayland runs its own version line, so it lands at 21.1.4 on 15.0 and 24.1.15 on -current while the rest jump to 1.20.14 / 21.1.26.

SUSE Linux

openSUSE issued another sweep of security fixes, and the ratings tell the story fast. Only one package earned the "critical" tag: Pillow, which absorbed 39 vulnerabilities. That is a serious headline, and not just on paper. Pillow is the image library quietly running under a lot of Python tooling, so a 39-CVE bump here has a genuinely wide blast radius. Everything else on Leap 16.0 lands in the "important to a moderate" range, which means worth patching soon but not worth pausing your morning for.

The second-biggest pile on Leap 16.0 is psqlODBC with 11 CVEs. The fixes cover the usual suspects: buffer overflows, missing length validation, an escape parser that forgot how to count, and log files that happen to follow symlinks. Rust's keylime and Google's cloud sap-agent bring 5 and 8 respectively, which is respectable for a single package.

A few specifics are worth pulling out. Two live patches go out for the SUSE Linux Enterprise 16 kernel, one for the standard build and one for RT, both closing the same ipv4 RCU leak in CVE-2026-98432. You get to skip the reboot, which is the entire point of a live patch. Several Tumbleweed GA-media entries mostly echo upstream component fixes rather than surfacing fresh problems.

Separate from that is the SUSE-SU-2026:5xxx stream aimed at the older SLE 15 lineages. That is where you find proftpd taking a hit for 7 vulnerabilities, including access-control bypasses that turn the FTP server into an open door, and dpdk with 12, most of them in its vhost and vhost-crypto paths. The mozilla-nss update carries no CVE number at all, since it is really about retiring a compromised CA and landing at NSS 3.125.1. GraphicsMagick shows up twice, once on Leap 16.0 and once on SLE 15, which just reflects the backport schedule drifting out of alignment.

The ID prefixes do the housekeeping for you: 2xxxx hits Leap 16.0, 12xxx is Tumbleweed on GA media, and 5xxx covers SLE 15.

Ubuntu Linux

Ubuntu just pushed a massive batch of security fixes dated November 2026, and the Linux kernel dominates the pile like always. If you run anything on AWS, GCP, Azure, IBM, or Oracle cloud, you should patch. You will also want to, if you own a Raspberry Pi, which three separate notices reached into across different releases.

A few threads are worth spotting before you wade into the version numbers.

The AMD SEV-SNP issue (CVE-2023-20585) shows up more often than a single bug deserves. It is old, and it keeps getting re-published under fresh kernel releases for AMD-based guests. The mechanism is the same every time: an attacker with hypervisor access trips an out-of-bounds condition against SEV-SNP guest memory. If you run confidential computing, reboot.

The newest 7.0 kernels (Ubuntu 26.04 and 26.10) take a cluster of io_uring problems. Memory leaks, unvalidated query sizes, wrong-task-context handling, and a buffer bug a remote actor could exploit. Most are denial-of-service noise, but one is remotely reachable, so treat that one as more than a bother if you feed untrusted input to io_uring.

Then there is the Tornado follow-up (USN-8952-3), which is the most honest notice in the batch. A prior fix broke static file serving for Jupyter-style apps by being too paranoid about symlinks into /usr/share, so this one walks it back. The vendor even apologizes. You rarely get a company admitting its own fix made things worse, so that earns a little credit.

Two non-kernel updates deserve a moment on their own. The uutils coreutils fix (USN-9041-1) for Ubuntu 26.04 patches a long list of TOCTOU races and permission slips in the Rust rewrite of coreutils, from cp preserving setuid bits to chroot pulling in NSS modules as root. That is a larger deal than the "several issues fixed" boilerplate lets on. The HPLIP notice (USN-9037-1) carries enough CVEs to make a printer driver feel like the back door it always kind of was, including command execution on the older 16.04 and 18.04 lines.

Do not skip the legacy buckets. Ubuntu is still shipping kernel patches for 14.04 LTS, which predates most of the people reading this. USN-9035-1 even closes a 2017 Turtle Beach audio driver hole, a quiet reminder that old code never really retires.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world