Eight Linux distros shipped security fixes, led by SUSE's SLE 16.1 kernel update carrying 2,819 CVEs and Ubuntu's NVIDIA Tegra notice clearing more than 1,000. Apache2 came under heavy fire across the batch, driven by a 9.8-rated mod_http2 flaw, while Red Hat independently flagged Satellite 6.19.6 as Critical for RHEL 9. Debian's linux-6.12 patch cleared over 100 CVEs and required extensions to be recompiled for CVE-2026-6460, and Gentoo's rsync update arrived with 34 high-rated CVEs that directly threaten the build process. Priority fixes are Apache with mod_http2, rebootable kernels, and critical async updates, with exact versions listed behind each distro's advisory IDs.

Linux distros push a staggering mountain of security patches today

SUSE alone is shipping a kernel with 2,819 CVEs. Ubuntu's Tegra notice tops 1,000. You probably run at least one of these.

If you manage even a single Linux server, today's roundup is one you don't want to skim. Eight distros shipped fixes between November 12 and November 14, and several of them go well beyond the usual monthly routine. The headline numbers are almost silly: SUSE's SLE 16.1 kernel update carries 2,819 vulnerabilities. Ubuntu's NVIDIA Tegra notice lists more than 1,000. That is a lot of CVEs to clear before your coffee goes cold.

The massive ones first

SUSE is the clear heavyweight here. Its batch touches SUSE Linux Enterprise, openSUSE Leap, and Tumbleweed all at once, and a good chunk of it tells you to reboot or restart whatever is running. Apache2 took the hardest hit, driven by CVE-2026-119618, a heap corruption and remote code execution flaw in mod_http2 that SUSE rates a 9.8. Two separate advisories cover it across the older 15.4/15.5 tracks and the newer 15.6 line, so if any of your servers load mod_http2, that one sits at the top of the queue.

Chromium and Python-Pillow rounded out the criticals. Chromium landed 975 CVEs. Pillow picked up 39, mostly denial-of-service and memory-corruption bugs across its image parsers. Neither is shocking on its own, but stacked together they add up to a patch cycle you'll remember.

The kernels are worth a glance on their own. Beyond the 2,819 CVE SLE main update, SUSE shipped NVIDIA-flavored kernels twice and folded 81 CVEs into a single nvidia driver package. You genuinely won't read them, but real fixes live underneath. It reads less like a patch and more like someone rewrote the kernel overnight.

Ubuntu mirrored the scale with USN-9091-1, targeting the NVIDIA Tegra kernel on Ubuntu 24.04 LTS. The notice pulls back the curtain on one issue in particular: AMD processors weren't performing their Reverse Map Table checks when the IOMMU touched certain host buffers. A local attacker with hypervisor access could create an out-of-bounds condition that undermines SEV-SNP guest memory. That's CVE-2023-20585. The rest of the notice is a wall of CVEs spanning file systems, drivers, networking stacks, and security modules. At some point the list stops being actionable and just becomes a number you glance at and move past.

Keep in mind that Ubuntu's house rules are blunt this week. Reboot after the update, and expect an ABI change. If you've installed third-party kernel modules like graphics, Wi-Fi, or storage drivers, you'll have to recompile and reinstall them. A standard upgrade handles the kernel metapackages on its own. Your own modules are really the only thing standing in your way.

The rest of the batch

Debian shipped a stack of advisories on November 13 and 14, and its linux-6.12 patch (DLA 4904-1) covers well over a hundred issues. The 6.12.115-2~deb12u1 version also absorbs non-security fixes from the 6.12.114 and 6.12.115 stable updates. A separate linux advisory hits trixie with version 6.12.117-1, fewer CVEs but same flavor.

PostgreSQL shows up twice in Debian's batch, once for trixie at 17 and once for bookworm at 15. Both clear the same cluster of trouble, now including arbitrary code execution and broken authentication. One wrinkle worth holding onto: CVE-2026-6460 isn't fully resolved until your extensions get recompiled against the new version. Debian says that work rides along on upcoming trixie point releases, so don't treat the update as a done deal just because it landed.

AlmaLinux, Rocky, and Red Hat rounded out the enterprise side. Red Hat filed just one advisory, RHSA-2026:100120, and flagged Satellite 6.19.6 as Critical for RHEL 9. It ships as an async update, outside the usual cadence, which is exactly the kind of thing that usually means someone should care quickly. If you run Satellite on RHEL 9, it belongs near the top of your queue.

Rocky pushed a genuinely large batch, fifty entries split between version 10 and version 8. Two sit at the very top: fence-agents and cockpit-image-builder both carry a Critical rating, and those are the ones worth patching before you've had your coffee. The rest lands at Important, where the kernel, openssh, krb5, and NetworkManager live. The net was cast wide here too, with emacs, grafana, flatpak, nginx, tomcat, tesseract, and even .NET 11 and a gcc-toolset-15 entry riding along.

Gentoo shipped three advisories on November 14, and rsync took the severity star with 34 CVEs rated high. The worst case is privilege escalation, and that deserves attention because emerge relies on rsync to pull the Portage tree. A hole in your fetcher leans the whole build process its way. Apache HTTPD came in at 23 CVEs with remote code execution on top, and Tor closed the batch with five bugs and 24 TROVE identifiers instead of the usual CVE mapping. None of the three ships a workaround, so the patch versions in each advisory are the only fix.

Fedora spread its fixes across 43, 44, and 45. dnf5 took the real hit, with both Fedora 44 and 45 patched for CVE-2026-123177, a hole in dnf5daemon-server that let unauthenticated callers feed it command-line specs it would then execute. X.Org server picked up eight CVEs and reaches both 43 and 44, which matters if you run a graphical desktop every day.

And then there's mtools 4.0.50 on Fedora 44. That closes a VFAT parsing denial-of-service bug. Nothing quite says frontier technology like spending November patching MS-DOS floppy parsing.

If you're keeping score, the priorities are clear. Patch Apache2 first if you load mod_http2, update the kernels you can reboot into, and clear the critical async updates before anything else. Most of these are straightforward bumps with no workaround, so the fix is usually just the version listed in the advisory.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux shipped its November errata batch for AlmaLinux 8, with one stray entry for version 10, and it follows the usual recipe: the things that tend to catch fire, sorted by how loudly you should care.

Firefox gets the big dump again. Mozilla pushes these sprawling vulnerability lists every cycle, and this one is no exception, packing 81 fixes that span use-after-free bugs, sandbox escapes and privilege escalation across nearly every browser component. That list also covers Thunderbird, which rides on the same engine. If either is on your systems, that single entry is the main reason to update.

The rest is more scattered, but skipping any of it stays a bad call. .NET gets patched across 8.0, 9.0 and 10.0 at the same time, mostly covering the same ASP.NET Core and .NET flaws. Updating one runtime while leaving another running just hands an attacker a side door. The kernel shows up four times, split across two severity levels, with kernel-rt mirroring the standard kernel's fixes in each case, so real-time and ordinary servers alike pick up the same patches.

On the quieter end of the spectrum there is still plenty of reason to patch. perl-CGI carries three solid holes, gcc and libpng have their own CVEs, and nginx ships two heap overflows. The JDK gets its customary "Enhance everything" treatment across 37 advisories. The OpenJDK advisory also carries one note worth reading: it uses the system certificate store, so to truly drop the compromised eMudhra certificates you have to update ca-certificates too, not just the JDK.

Altogether the batch touches 26 errata entries and clears more than 220 CVEs. The breakdown below covers each one.

Debian GNU/Linux

Debian shipped a stack of security advisories on November 13 and 14, 2026, and the biggest thing in the box is a kernel update with more CVEs than you'd want to count at one sitting.

The linux-6.12 patch (DLA 4904-1) for Debian 12 bookworm covers well over a hundred issues spanning privilege escalation, denial of service, and information leaks. Read down the list and it stops reading as a security advisory and starts looking like a phonebook. The version, 6.12.115-2~deb12u1, also absorbs the usual complement of non-security bug fixes from the 6.12.114 and 6.12.115 stable updates. A separate, plainer "linux" advisory (DSA 6628-1) hits the current stable release, trixie, with its own haul of kernel flaws in version 6.12.117-1. Same flavor, newer packages, and far fewer CVEs to slog through.

PostgreSQL shows up twice in the same breath. postgresql-17 (DSA 6625-1) for trixie and postgresql-15 (DLA 4905-1) for bookworm both clear the same cluster of trouble, now including arbitrary code execution and broken authentication. One wrinkle worth holding onto: CVE-2026-6460 is not fully resolved until your extensions get recompiled against the new version, and Debian says that work will travel along on upcoming trixie point releases. If your database leans on custom extensions, don't treat the update as a done deal just because it landed.

The rest of the batch is smaller and more ordinary. sympa, a mailing-list manager, had a path traversal plus an access-bypass flaw that put deleted and raw archive files in reach. c-ares, the asynchronous DNS resolver library, takes a mixed bag of memory-corruption bugs (use-after-free, double-free, buffer overflows), DNS spoofing, and a habit of accepting replies from the wrong servers. libspreadsheet-xlsx-perl, the Perl module that reads Excel files, could hand an attacker arbitrary code execution or a denial of service off a maliciously crafted spreadsheet.

Then there's the Extended LTS crew from FreeXian, keeping life support going for software Debian has already shipped to the scrap heap. apache2 (ELA-1887-1) on the venerable bullseye disposes of a long list of problems including remote code execution and HTTP request smuggling, and as a small courtesy they disabled RFC 2069 digest authentication, which had been obsolete and insecure for years. Django (ELA-1886-1) rolls out for stretch, buster, and bullseye, closing a memory-exhaustion bug in file uploads and a quirk in Vary headers that let cached responses leak private data across requests.

Fedora Linux

Fedora pushed a fresh batch of security updates on November 14th and, rather than picking one release to focus on, spread them across Fedora 43, 44, and 45. If you're running any of those, this is worth a look.

The one that actually makes you sit up is dnf5. Both Fedora 44 and 45 are getting patched for CVE-2026-123177, a hole in dnf5daemon-server that let unauthenticated callers feed it command-line specs it would then execute. That's a straightforward privilege-escalation fix, so grab whichever version you're on.

X.Org server took the heavier hit. Eight CVEs show up in the changelog, and this one reaches both Fedora 43 and 44. If you're in a graphical desktop, that's the package you genuinely use every day.

The Ruby side landed on Fedora 45, where Nokogiri jumped to 1.19.7 fixing three security advisories and Loofah is being adjusted to keep up with Nokogiri's corrected HTML5 behavior. Not the most exciting news, but both sit underneath a surprising amount of web-facing Ruby code.

Two separate MySQL releases also showed up: 8.4.13 and 9.7.4, both from October 20th. These read as more like maintenance bumps than security landings, though the changelog does flag platform work like implementing my_timer_cycles() on riscv64. Firefox 160.0 only reaches Fedora 43, Radicale crept to 3.9.1 on 45, and mtools 4.0.50 on 44 closes a VFAT parsing denial-of-service bug. Nothing quite says frontier technology like spending November patching MS-DOS floppy parsing.

You can pull any of these in with dnf upgrade --advisory plus the relevant FEDORA ID from the table below.

Gentoo Linux

Gentoo pushed out three security advisories on November 14, 2026, hitting three pieces of software most people run daily without giving them a second thought: the web server, the file-sync tool, and the anonymity network.

The severity star goes to rsync. Rated high with 34 CVEs, the worst case is privilege escalation, and that deserves attention because emerge relies on rsync to pull the Portage tree. A hole in your fetcher leans the whole build process toward it. The fix is simple: get to 3.5.2.

Apache HTTPD shows up as GLSA 202611-10, normal severity but 23 CVEs with remote code execution at the top of the impact list. Running anything under 2.4.71 means you are behind. Bump to 2.4.71 and you are back in the clear.

Tor closes the batch. Five bugs were filed against it, and the advisory cites 24 TROVE identifiers instead of CVEs, so it does not hand you the usual CVE mapping. Normal severity, but remote code execution tops the impact list. Anyone below 0.4.9.17 should update.

None of the three ships a workaround, so there is no clever way around the update. The patch versions in each advisory are the fix.

Red Hat Enterprise Linux

Red Hat filed one advisory this time around, RHSA-2026:100120, and rated it Critical for a change you probably weren't expecting to see flagged that hard.

Satellite 6.19.6 lands as an async update for RHEL 9, meaning it ships outside the usual fixed cadence because the severity demanded attention. Red Hat Product Security puts the security impact at Critical, so if you are running this version of Satellite on RHEL 9, it belongs near the top of your update queue.

Rocky Linux

Rocky Linux pushed a genuinely large errata batch for version 10 and managed to squeeze in six more for version 8 before the ink dried. All fifty are security focused, though a handful also tuck in bug fixes and feature enhancements under the same covers.

Most of the weight lands on Rocky Linux 10. If you run anything modern, that's the list that matters. Two sit at the very top of the severity ladder: fence-agents and cockpit-image-builder both carry a Critical rating, and those are the ones worth patching before you've had your coffee. A long string more land at Important, which is where the kernel, openssh, krb5, and NetworkManager live. Those are the parts you don't want to be reading about in a post-mortem.

What's noticeable is how wide the net was cast. This isn't just daemons and libraries. You've got emacs, grafana, flatpak, nginx, tomcat, tesseract, and even .NET 11 and a gcc toolset riding along. The gcc-toolset-15 and .NET 11.0 entries suggest the maintainers are quietly updating the toolchain stack alongside the usual maintenance pass. A couple of surprises deserve a glance, like dpdk for developers working on data-plane code and gstreamer plugins spread across three separate advisories.

The version 8 updates are comparatively modest. Six entries, mostly Important, and the standouts are the still-annoying java-1.8.0-openjdk, perl-CGI, webkit2gtk3, and a second xfsprogs. Version 8 is in its later years, so any of these still counts as a win.

One thing worth flagging: every single advisory closes with the same boilerplate about CVSS scores being available on the CVE list. The real detail lives on the errata pages themselves, not in these headlines. You'll find the links in the table below.

All updates

SUSE Linux

SUSE shipped a genuinely enormous stack of security patches this week, touching SUSE Linux Enterprise, openSUSE Leap, and Tumbleweed. The bundle reads less like a routine update and more like a whole release calendar got compressed into a single day. Some of these warrant immediate action, and several ask you to reboot or restart whatever is running.

The criticals are where the real exposure sits. Apache2 took the hardest hit, driven by CVE-2026-119618, a heap corruption and remote code execution flaw in mod_http2 that SUSE rates a 9.8. Two separate advisories cover it across the older 15.4/15.5 tracks and the newer 15.6 line, so if any of your servers load mod_http2, that one belongs at the top of the queue. Python-Pillow (39 vulnerabilities) and Chromium (975 of them) also landed as critical. Pillow's fixes mostly target denial-of-service and memory corruption across its image parsers, while Chromium's list is the usual browser mix of use-after-free bugs and buffer overflows.

The kernels deserve a glance. The main SLE 16.1 kernel update claims 2,819 vulnerabilities and 2,909 bug fixes, which is less "patch" and more "someone rewrote the kernel overnight." NVIDIA-flavored kernels show up twice (Leap 16.1 and 16.0), along with the 16.0 main kernel. You will not read them, but they are large and they carry real fixes underneath.

Firefox keeps receiving the monthly sweep of use-after-free bugs, and this cycle follows the pattern. The SLE ESR build moves to 153.7.0 with a sprawling CVSS list, while Leap got 153.6.0 ESR. If you run Firefox anywhere near production, treat both as mandatory.

Underneath the headline items sits a sprawl of two-bug or single-bug fixes across GraphicsMagick, aspell, jsoup, evolution, X, and a grab bag of Kubernetes utilities for Tumbleweed. A few items stand out from the crowd: the xen update explicitly asks you to reboot after installing it, the open-iscsi update quietly folds a version bump and feature work into its security fixes, and the nvidia driver package quietly absorbs 81 CVEs in one go.

Ubuntu Linux

Ubuntu published two kernel security notices on the same day, November 13, 2026, and the first one is staggering in scale. USN-9091-1 targets the NVIDIA Tegra kernel on Ubuntu 24.04 LTS and patches just about every subsystem you can imagine. The notice pulls back the curtain on a single issue in real detail: AMD processors weren't performing their Reverse Map Table checks when the IOMMU touched certain host buffers, letting a local attacker with hypervisor access create an out-of-bounds condition that undermines the integrity of SEV-SNP guest memory (CVE-2023-20585). The rest of the notice is a wall of CVEs, more than 1,000 of them, spanning file systems, drivers, networking stacks, and security modules. At some point the list stops being actionable and just becomes a number you glance at and move past.

The second notice, USN-9027-2, is the FIPS kernel for Ubuntu 22.04 LTS, and it is a much smaller affair. Five CVEs land across the x86 architecture, hardware monitoring drivers, the OCFS2 filesystem, IPv4 networking, the Ethernet bridge, Netfilter, and XFRM. FIPS-certified kernels sit behind Ubuntu Pro, so this update won't show up on a free install. It also supersedes USN-9027-1, meaning the FIPS fixes rolled out in stages.

Either way, the house rules are identical. Reboot after the update, and watch out for the ABI change. If you've installed third-party kernel modules like graphics, Wi-Fi, or storage drivers, you'll have to recompile and reinstall them. A standard upgrade handles the kernel metapackages on its own, so your own modules are really the only thing standing in your way.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world