Today's daily Linux security roundup landed across eight distros, led by Fedora's massive Chromium update carrying 58 CVEs. Critical fixes went to the unbound DNS resolver in both Red Hat and Rocky Linux, while Apache Unbound, IPA, and the Ansible Automation Platform also drew top-severity flags. Firefox, PostgreSQL, and the container toolchain (podman, runc, containernetworking-plugins) show up across nearly every distro, though patch effort varies by release. And in a rare twist, USN-8287-2 is Ubuntu apologizing for regressing its own earlier XDG Desktop Portal fix.

This daily Linux security roundup: a 58-CVE Chromium fix, Critical DNS holes, and a distro apology

Fedora's Chromium update carries 58 CVEs, the single biggest patch in today's Linux security roundup. A couple of DNS fixes picked up a Critical rating at the same time, and one of them is Ubuntu formally apologizing. Keep reading before you touch any of it.

The September 24 wave landed across eight distros at once: AlmaLinux, Debian, Fedora, Oracle Linux, Red Hat, Rocky Linux, SUSE, and Ubuntu. Most of it is the standard daily batch, but a few entries deserve an immediate update rather than a spot in your queue.

Start with the Criticals

Unbound, the DNS resolver, got a Critical fix in both Red Hat and Rocky Linux. Broken DNS is the kind of failure you notice within seconds, so that one earns first pass whether or not you run your own resolver. RHEL split the update across 8, 9.6, and 10 with four separate advisories, while Rocky's version stays a clean security-only patch.

Red Hat also tagged IPA identity management for RHEL 9 Critical and threw four Critical fixes at the Ansible Automation Platform covering 2.4 through 2.6. The 2.7 build draws just an Important tag, which is the same old pattern where the newest release gets the shortest treatment.

Then there's the patch that earns a genuine smile. USN-8287-2 is Ubuntu apologizing for breaking its own fix from USN-8287-1. The earlier XDG Desktop Portal update shipped an incomplete patch and regressed on file trashing, so this one just cleans up the wreckage. A security notice that says "we apologize for the inconvenience" is a rare treat.

The headline CVE counts

Fedora's Chromium jump to 153.0.8010.52 packs use-after-free bugs, type confusion, out-of-bounds reads, and a few RCE-flavored integer overflows in V8. The advisory's own description reads like a running joke, describing a WebKit-powered browser "that Google doesn't want you to use." On-brand framing for a company that spends most of its time making sure you don't run that browser.

AlmaLinux pushed 14 advisories in one day, almost all rated Important. PostgreSQL is where the real story lives, with the AL10 postgresql16 update alone listing 16 CVEs routed through arbitrary code execution. A database that lets a crafted query run code on your box is the sort of thing you want fixed before lunch, not before tomorrow morning.

Firefox shows up everywhere, though it jumps to ESR 140.16 on Oracle's OL10 and OL9 while OL7 sits three feature releases behind at 140.13.0. That backlog gap is the reason to actually check that old legacy box before you assume it's safe.

Beyond the headlines

Most of this batch is just the steady hum of hardening. ImageMagick landed seven vulnerabilities across nearly every Ubuntu LTS, memory and integer bugs that mostly do denial of service but can run code if you open the wrong crafted file. NetworkManager picked up a real hole on 26.04 for not restricting certificate authority paths on WPA-Enterprise connections, and libgit2 lets a remote attacker run commands through a mishandled SSH URL.

The container toolchain shows up in pieces too. podman, runc, and containernetworking-plugins all get rebuilt across AlmaLinux, Oracle, and Rocky, usually as dependency rebuilds rather than fresh code. It's the kind of update where the package file changes more than what's inside, so treat the set as one coordinated change and bump them together.

Severity ratings rarely tell the whole story here. Red Hat's batch sits mostly in Important land with 38 of 58 updates, plus 8 Critical and 10 Moderate. But a Low rating on libxml2, which appears twice in the RHEL set, doesn't mean Low risk for whatever machine hosts it.

The Updates in Detail

AlmaLinux

AlmaLinux pushed 14 security advisories in a single day on September 23, 2026, and almost every one of them carries an Important rating. Two are Moderate. If you run anything on this list, this is a "patch now and move on" situation rather than a "read 14 long emails and take notes" one.

PostgreSQL is where the headlines are. The AL10 postgresql16 advisory alone lists 16 CVEs, with 15 in the AL9 postgresql package. The phrase "arbitrary code execution" repeats so often it becomes background noise: integer wraparound in tsvector and tsquery, heap buffer overflows in regexp, type confusion in the cursor lifecycle, and SQL injection lurking inside EXTRACT() deparse, with several more routed through plperl and pltcl. A database that lets a crafted query run arbitrary code is exactly the sort of thing you want to fix before lunch.

Firefox gets the same ten fixes rolled out across three versions (AL8, AL9, AL10). Sandbox escapes, use-after-free bugs, and a privilege escalation make up most of the list. You're bumped up to Firefox 155, or to ESR 153.2, 140.15, or 115.40 depending on how old your browser is.

The kernel is where the volume gets staggering. The standard kernel ships for both AL8 and AL9, and a real-time variant (kernel-rt) goes to AL8. The AL9 kernel alone carries 30 CVEs plus five bug fixes touching gfs2, dlm, and a watchdog that used to panic machines during reboot. Bluetooth shows up in the AL8 batch almost as though it had a quota to fill.

The container toolchain isn't left out either. Podman (AL9 and AL10) takes on a handful of Go standard-library issues: several denial-of-service vectors, a cross-site scripting bug, a certificate validation bypass, and an arbitrary file write via tar extraction. runC and containernetworking-plugins mostly inherit the quadratic-complexity net/url DoS. tar rounds out the AL8 list with path traversal and hidden-file injection.

Debian GNU/Linux

Debian pushed out a batch of advisories on September 23, and as tends to happen with these, a good chunk of it isn't actually a security fix. Two of the four advisories are just the tzdata 2026c timezone database, rolled out once for Debian 12 bookworm via LTS and again for the Perl bindings in libdatetime-timezone-perl. A third repeats that same tzdata bump for older Debian releases still hanging around under Extended LTS. The other two are the ones worth your attention.

The more interesting of the pair is xdg-dbus-proxy, which carries a genuine bug. Setting a reply serial number on a non-reply message lets an attacker slip past the filtering on the D-Bus session bus, and for a Flatpak app that means escaping its sandbox to run arbitrary code on your machine. Anything that leans on the proxy the same way Flatpak does is exposed until it gets updated, and stable (trixie) ships the fix at version 0.1.6-1+deb13u3.

znc gets two CVEs, both denial-of-service flavor. No code execution here, just a way to knock your IRC bouncer over, but if you run one you probably don't want it crashing at 3 a.m. That's fixed in 1.9.1-2+deb13u1 for stable.

The tzdata changes are the kind that only bite if your clock does anything interesting. Alberta locks in to a permanent -06 starting June 18, skipping the November fallback. Morocco moves to permanent +00 as of September 20. And the leap second list got refreshed before it would have expired at the end of December. If you haven't thought about time zones in years, this is the part of the batch you likely don't need to act on, though a quick update costs you nothing.

Fedora Linux

Fedora just filed a stack of security patches at Fedora 43 and 44, and the one that pulls the most weight is Chromium. Fedora 43's chromium moved to 153.0.8010.52 with a literal wall of fixes: 58 CVEs covering use-after-free, type confusion, out-of-bounds reads and writes, and a few RCE-flavored integer overflows in V8. The advisory's own description reads "A WebKit (Blink) powered web browser that Google doesn't want you to use," so the framing is on-brand.

On the same Fedora 43, you also get a 7.2.7 stable kernel. It quietly reverts an alg_restrict sysctl change and keeps the older NTFS3 module around, which tells you someone in Fedora was still depending on it and asked for it to stay. A mingw-pcre2 upgrade lands here too, closing eight memory-corruption bugs, two of which let an attacker run arbitrary code.

Fedora 44 picked up that same pcre2 fix and added an unbound update that shuts nine DNSSEC-related holes. Several were reported by researchers at Nankai University, Palo Alto Networks, Anthropic, and Marlink Cyber.

If you're running either release, a single dnf command applies each advisory.

Oracle Linux

Oracle Linux just pushed a wide batch of security and bug-fix advisories across four generations of its OS, from OL7 all the way up to OL10. Thirty advisories went live on the Unbreakable Linux Network, and Firefox is handling its usual job of carrying the longest CVE list in the building.

Firefox shows up three ways, on OL10, OL9, and OL8, each jumping to the 140.16.0 ESR and each absorbing 28 newly disclosed CVEs. OL7 sits three feature releases behind at 140.13.0 ESR, and it collected its own haul of 33 CVEs as a result. That backlog gap is why you should probably check the browser on that legacy box before assuming it is safe.

The container stack got a cascade rather than a single fix. podman (on both OL10 and OL9), runc, and containernetworking-plugins all got rebuilt, and they hand off a overlapping set of CVEs from a common dependency bump. It is the kind of update where Oracle changes the package file more than it changes the code inside, but the fixes still land, so treat the three as one coordinated change and bump them together. If you run anything containerized, leave the whole set in place.

Networking and remote-access tools got the most actual code work. curl on OL10 absorbed fixes for cookie injection, a digest-auth state leak, and a SASL service-name reuse bypass, spread across two sub-releases. OpenSSH is the one worth your attention: the OL9 build (9.9p1-11) closes a use-after-free in the ssh client, an sftp path-control flaw, and a forwarding-and-tunneling bypass. The OL8 OpenSSH (8.0p1-33) follows the same pattern, plus a note about not running constructors on dlopen(), which reads like scar tissue left over from that GSSAPI fiasco a while back.

Databases took their expected route. PostgreSQL 16 on OL10 and PostgreSQL 15 on OL9 both moved to their latest point releases, each clearing 16 CVEs. bind on OL10 is the densest single patch in the set: a backport pile-up resolving 9 CVEs at once, ranging from cache poisoning to a GSS-API leak. If DNS is part of your stack, actually read that changelog instead of letting the package manager tick along.

The rest is the familiar roster, mostly single-CVE hardening: rsyslog (a heap buffer overflow in the RainerScript replace function, on both OL9 and OL10), tar and coreutils on OL8, unbound's cache-poisoning patch, freerdp, libtiff, libxml2, openexr, gstreamer, perl-DBI, libarchive, guestfs-tools, host-metering, and 389 Directory Services on OL7.

Most carry the "Important" flag, while OL8's tar, coreutils, libxml2, apr-util, and unbound sit at Moderate, and OL10's libarchive lands at Low. The Moderate ones still deserve your time. A Low rating on an old library does not mean Low for the machine hosting it.

Red Hat Enterprise Linux

Red Hat released a meaty wave of advisories this round, and Oracle joined in with two. Tallying it up, you've got 58 updates across the board, spanning RHEL 8 through 10, plus two Oracle Linux advisories. Most of these are straight security fixes, which is more than you can say for the usual "and bug fixes" flavor text Red Hat tends to sprinkle in.

A few things you probably want to patch first. There are four Critical unbound (the DNS resolver) updates, hitting RHEL 8, 9.6, and 10 twice over. If you run your own DNS, this is the thing. Red Hat also issued a Critical fix for IPA (identity management) on RHEL 9, and four Critical fixes for the Ansible Automation Platform covering 2.4 through 2.6, with 2.7 earning just an Important tag. It is a little funny how often the newest release gets the shortest attention.

Beyond that is the more ordinary mix: kernel updates, a trio of glib2 and libsoup fixes, and what amounts to a PostgreSQL moment with updates scattered across 12, 15, and 16. Qt, freerdp, buildah, skopeo, vim, sudo, and IBM Java all turn up as well. On the Oracle side, Firefox lands ESR updates for Linux 9 and 10 carrying a very long list of CVEs.

By severity this batch lives mostly in Important land with 38 of the 58. Add in 8 Critical, 10 Moderate, and just 2 Low, both of which are libxml2, a library that rarely gets anyone's heart racing.

Rocky Linux

Rocky Linux has filed a fresh batch of security errata across all three of its supported releases, which means you are probably patching on more than one machine rather than doing a single clean sweep. Nearly half the updates land on Linux 8, with the rest split between 9 and 10.

Only one reaches Critical: unbound on Linux 8. Since broken DNS resolution is a problem you notice fast, that one earns a first pass, and it is at least a straightforward security-only patch.

The rest is the usual mix. The kernel and its real-time variant both hit Linux 8, security fixes bundled with bug fixes and enhancements. The container stack shows up in pieces, with podman, runc, and containernetworking-plugins all addressed. Postgres gets hammered on multiple fronts, versions 12, 15, and 16 all patched, and the Linux 8 builds notably also refresh pg_repack, postgres-decoderbufs, and pgaudit. Firefox shows up too, though only on Linux 9.

At the low end sit tar, coreutils, libxml2, and libarchive, which settle at Moderate except for libarchive at Low. Those are the ones you can schedule around a coffee break instead of dropping everything, but they are still real vulnerabilities worth closing. Every entry maps to a CVSS base score, so if you want to rank them by exact number you can pull them from the CVE list.

SUSE Linux

SUSE filed a batch of security announcements on September 23, 2026, spanning the mildly annoying to the genuinely worth your time. Most are the usual single-vulnerability patches for a handful of packages, but a few are worth acting on.

The biggest bundle lands on apptainer, which picks up six fixes: SSH source-address restriction bypasses, a DoS on deadlocked channels, and a trio of gRPC misadventures (an authorization policy bypass, heap exhaustion via HTTP/2 framing, and a crash on missing headers). It shows up on a grab-bag of SLE 15 SP6/SP7 systems, the HPC module, and openSUSE Leap 15.6.

Gimp gets five security fixes plus two non-security follow-ups, which SUSE bothered to spell out separately. You get arbitrary code execution in the PSD plugin, overflows across the SGI, PCX, and XWD loaders, and a DoS via FLI file processing.

Podofo is the nostalgic one, patching CVEs that date back to 2018, 2020, and 2021. That is the sort of old debt cleanup you usually want before it becomes your problem.

Two kernel live patches cover the exact same five CVEs. One targets the 5.14 kernel on SLE 15 SP5, the other the 6.4 kernel on SLE 15 SP6, and live patching means you should be able to apply it without rebooting.

The remaining moderate updates are the steady hum: python-WebOb's redirect target can be abused for phishing and OAuth/SSO token theft, libX11-6 picks up a serious graphics-stack hole, and librepods plus graphifyy round out the list.

Ubuntu Linux

Ubuntu cleared its outbox again this week, and if you run anything on the older LTS releases there is a decent pile of updates to get through. Most of these are the usual maintenance kind. A handful are worth your time because they touch software that actually talks to the network.

The loudest one is ImageMagick. Seven vulnerabilities across nearly every supported release, covering memory mishandling and integer arithmetic bugs. Most are denial-of-service headaches, but a few let an attacker run arbitrary code. The normal caveats hold: you have to open the specially crafted image for the worse outcomes, and these are the classic "don't drag suspicious files into the converter" situations.

Two others bite in places you might not expect. libgit2 mis-handles SSH repository URLs, which leaves room for a remote attacker to run commands on your box. NetworkManager affects only the new 26.04 release, but the hole there is genuine: it will not properly restrict certificate authority paths on single-user 802.1X connections, so someone on a WPA-Enterprise network can steer you toward a rogue authority and lift your credentials.

Then there is the notice that earns a small smile. USN-8287-2 is Ubuntu formally apologizing for breaking its own fix from USN-8287-1. The original XDG Desktop Portal patch shipped an incomplete fix and regressed on file trashing, and this one simply cleans up the wreckage. The "we apologize for the inconvenience" line in a security notice is a rare treat.

Here is the pattern you will keep hitting: nearly every entry for the older LTS releases (14.04, 16.04, 18.04, 20.04) carries "Available with Ubuntu Pro." That means the fix is not free if you are running those releases without a Pro subscription. The Moodle notice is the quiet oddball, patching CVE-2019-3809, an SSRF bug from nearly a decade ago, on 18.04 and 16.04 machines that simply refuse to retire.

A standard system update covers all of it. The table below breaks down each notice by package, the affected releases, the CVEs involved, and the version you are after.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y