Debian's kernel advisory alone carried 611 CVEs, the standout of today's security roundup across AlmaLinux, RHEL, Rocky, SUSE, and Fedora. Red Hat shipped 32 errata advisories with a single Critical hit, a kernel fix for RHEL 9.4 Update Services for SAP Solutions, while the rest leaned Important. Several problems resurface across vendors, most notably Ghostscript's stubborn .charkeys -dSAFER bypass and fixes for the eMudhra intermediate CA compromise. The practical takeaway is to install the specific advisory builds by version rather than letting a blanket upgrade take its chances.

Linux distros ship a fresh pile of security updates, and Debian's kernel note alone packs 611 CVEs

Debian handed a single kernel advisory 611 CVEs this week. The rest of the Linux world rolled out more routine patches across AlmaLinux, RHEL, Rocky, SUSE, and Fedora.

Debian's kernel advisory alone carried 611 CVEs in one errata note, a number big enough that you want to double-check nobody fat-fingered the count. It wasn't a typo. The Linux kernel is simply carrying a lot of backlog right now.

The rest of the Linux world rolled out more routine but still necessary security patches this week, stamped November 2 and November 3. Run your updates. That's genuinely the whole story for most of them.

The numbers that actually matter

Debian and freexian cleared a large stack of advisories on November 2, and the kernel is the one that makes you pause. The fixed build is 6.12.115-2 for trixie. Debian didn't spell out what each of the 611 flaws actually does, only that they can lead to privilege escalation, denial of service, or information disclosure. You know the drill: patch it, then reboot.

Strongswan isn't something most people run, but it got 10 CVEs. A couple of them are the boring kind, memory leaks and undefined accesses that crash the openssl and x509 plugins. Others are worth pausing over. One lets an attacker skip authentication on an unestablished IKE session and spin up a child session early. Another drops inner EAP details in a way that could let identity binding slip. Both sound like the kind of thing you patch before bed.

freexian covers the extended-LTS crowd, the distros Debian's own LTS track has already moved past. dovecot took the heaviest hit, a grab bag of 23 CVEs spanning SMTP smuggling, SQL injection, and an OAuth2 scope check so loose that a token carrying only part of the required scopes could still authenticate. eog picked up two PNG parsing overflows. expat, the XML parser quietly sitting under a big chunk of the software universe, came with a heap and integer overflow sweep, including one that reportedly leaks pointers strong enough to defeat ASLR. That last detail is the whole reason to upgrade.

Chromium got its usual browser pile, pushed to trixie as 156.0.8078.79-1~deb13u1. Incus came with CVE numbers left blank, which is normal for fast-moving holes but means you're taking Debian's assurance rather than a documented proof. git-annex carried a single data-exfiltration flaw, which matters most if you keep anything outside git itself.

Then there's the recurring thread. That Ghostscript appearance in Fedora is worth a second look, because it's the .charkeys -dSAFER bypass again. The same one turned up separately in the AlmaLinux and RHEL rounds this week. One advisory for three separate vendors isn't a coincidence, and a single gadget that keeps showing up in Ghostscript's PDF interpretation path is exactly the kind of thing you patch before you sleep.

What actually needs your attention

AlmaLinux stamped a pile of advisories with the same release date, November 2, and a fair number are the same problems wearing different hats. The one entry worth paying attention to is the kernel fix CVE-2026-98432, now in the regular production repos for AlmaLinux 8, 9, and 10. That means you can stop pointing at the testing repo you were told to enable earlier. The pinned versions are kernel-4.18.0-553.182.1.el8_10 for AL8, kernel-5.14.0-687.64.1.el9_8 for AL9, and kernel-6.12.0-211.72.1.el10_2 for AL10.

The only Critical item is the .NET 8.0 advisory, ALSA-2026:86594, carrying 21 vulnerabilities across .NET and ASP.NET Core, including remote code execution, privilege elevation, and a security feature bypass. The SDK is 8.0.132 and the runtime 8.0.32. The kernel advisories are where the repetition gets loudest: the AL8 kernel update and the AL8 kernel-rt update list the identical seven fixes, so one update absorbs most of it.

Fedora shipped two waves on November 3, one for Fedora 43 and one for Fedora 44. If you track the Python toolchain you already recognize most of the names. uv got refreshed to 0.13.5, pulling in a stack of companion Rust packages. It ships with breaking changes, though upstream insists most users won't hit them. The part that matters is the security side: rustls and webpki get fixes for the eMudhra intermediate CA compromise, and uv now defers to the system certificate store by default instead of bundling its own roots. ruff jumped to 0.17.2.

The Fedora 44 batch is where the real CVEs pile up. libsoup3 cleared eleven, from WebSocket buffer overflows to a request-smuggling hole. Pillow backported three, one of which turns a Ghostscript call into a potential remote code execution. tpm2-tss, openjpeg, zvbi, perl-libnet, glib-networking, mingw-cfitsio, and erlang's hex_core each pulled their own. Both kernel updates landed the 7.2.15 stable release, and Justin M. Forbes reverted the af_alg_restrict sysctl to its prior state. You won't notice that change until something starts misbehaving.

Red Hat shipped 32 errata advisories. Most lean Important. Only one crosses into Critical: a kernel update for RHEL 9.4 Update Services for SAP Solutions, RHSA-2026:94109. That's the single fire drill this week. Several packages show up more than once. Bind gets hit from multiple directions. libXi appears across RHEL 8, 9, and 10. The kernel isn't a single package either, with the standard kernel, a real-time variant, and an NVIDIA-branded kernel for RHEL 10 all getting fresh code. Sort your systems by version and the patching mostly follows itself.

Keep in mind that Red Hat's CVSS base scores live in the errata References section rather than the headline, so open any Critical or Important you're actually going to install. Rocky Linux kept it simpler with two updates, tagging python-urllib3 Important on Rocky Linux 10 and perl:5.32 Moderate on Rocky Linux 8. SUSE shipped its own batch, where Firefox alone closed 77 vulnerabilities at once and rootlesskit was simply rebuilt against the latest Go security release rather than patched CVE by CVE.

If you're running any of these, the practical move is straightforward. Point dnf at the specific advisory IDs rather than letting a blanket upgrade take its chances. The 611-CVE kernel note isn't something to panic over, but it's also not something to leave unpatched until your next maintenance window goes out of date.

A Detailed Overview

AlmaLinux

A fresh pile of AlmaLinux security advisories dropped all stamped with the same release date, 2026-11-02, and a fair number of them are the same problems wearing different hats. The takeaway if you run AlmaLinux is straightforward: run your normal update, and don't sweat the overlap.

The one entry that isn't noise is the CVE-2026-98432 kernel fix. It now sits in the regular production repositories for AlmaLinux 8, 9, and 10, so you can stop pointing at the testing repo you were told to enable. The pinned versions are kernel-4.18.0-553.182.1.el8_10 (AL8), kernel-5.14.0-687.64.1.el9_8 (AL9), and kernel-6.12.0-211.72.1.el10_2 (AL10). Everything before that was just staging this for the main channel.

The .NET 8.0 advisory (ALSA-2026:86594) is the only Critical item on the list, and it carries the most ammunition: 21 vulnerabilities across .NET and ASP.NET Core, including remote code execution, elevation of privilege, and a security feature bypass. Ghostscript is back on the menu for the same .charkeys -dSAFER bypass it apparently kept picking up again.

The kernel advisories are where the repetition gets loudest. The AL8 kernel update and the AL8 kernel-rt update list the identical set of seven fixes, and the earlier kernel-rt advisory echoes the same ground. You won't need to patch each CVE on its own; one update absorbs most of it.

Debian GNU/Linux

Debian and freexian cleared a large stack of security advisories on November 2, 2026. The one that makes you stop and count is the Linux kernel, which packed a staggering 611 CVEs into a single advisory. That's not a rounding error, and it's enough to make you wonder what had been sitting unpatched. The kernel folks weren't specific about what each flaw does, only that they can lead to privilege escalation, denial of service, or information leaks. Your move is obvious: reboot into the fixed 6.12.115-2 build and get on with your day.

Strongswan, the IKE/IPsec suite, took a harder to ignore hit with ten distinct CVEs. Several are the mundane-but-annoying variety, memory leaks and undefined accesses that crash the openssl and x509 plugins. A few are worth your actual attention, particularly one that lets an attacker skip authentication on an unestablished Ike session and create a usable child session, and another where missing inner EAP details could let identity binding go wrong. The latter smells like an authorization shortcut, which is the kind of thing you patch before you sleep.

The regular Debian security batch rounded out the morning. Chromium got the usual browser pile of arbitrary code execution and information disclosure, pushed to trixie as 156.0.8078.79-1~deb13u1. Incus, the container and virtual machine manager, came with CVE numbers left blank ("not yet available"), which is normal for fast-moving holes but means you're taking Debian's assurance rather than a documented proof. git-annex carried a single data-exfiltration flaw in how it relays files through special remotes, which matters most if you keep anything outside git itself.

freexian handled the extended-LTS crowd, covering distros Debian's own LTS track has already moved past. dovecot got crushed, a grab bag of 23 CVEs spanning SMTP smuggling, SQL injection, and an OAuth2 scope check so loose that a token carrying only part of the required scopes could still authenticate. The image viewer eog picked up two PNG parsing overflows, the classic "someone sends you a picture and things break" story. expat, the XML parser quietly running a big chunk of the software universe, came with its own heap and integer overflow sweep, including one that reportedly leaks pointers strong enough to defeat ASLR. That last detail is the whole reason to upgrade.

Fedora Linux

Fedora delivered two waves of security updates on November 3rd, one for Fedora 43 and one for Fedora 44, and if you track the Python toolchain you'll already recognize most of the names appearing twice.

The shared story across both releases is the same one: uv got refreshed, and it pulled a whole stack of companion Rust packages along with it. Version 0.13.5 of uv ships with some breaking changes, though upstream insists most users won't hit them. The part you actually care about is the security side. That build pulls in newer rustls and webpki that patch fixes for the eMudhra intermediate CA compromise, and uv now defers to the system certificate store by default instead of its own bundled root certificates. That last bit is exactly the kind of adjustment that quietly makes things work better once you stop fighting it. ruff jumped to 0.17.2 and the type checker ty reached 0.0.91, each with their own minor breakages.

Both the kernel updates landed the 7.2.15 stable release, plus Justin M. Forbes reverting the af_alg_restrict sysctl to its prior state. It's the kind of change nobody notices until something starts misbehaving.

The Fedora 44 batch is where the real CVEs accumulate. libsoup3 swallowed the biggest pile, clearing eleven vulnerabilities that range from WebSocket buffer overflows and HTTP/2 crashes to a request-smuggling hole. Pillow had to backport three fixes, one of which turns a Ghostscript call into a potential remote code execution, a prospect you probably do not want sitting in your image pipeline. tpm2-tss, openjpeg, zvbi, perl-libnet, glib-networking, mingw-cfitsio, and erlang's hex_core each drew their own attention, covering everything from denial-of-service states to TLS certificate validation failures.

The rest are straightforward version bumps with no real urgency: radicale climbs to 3.9.0 on both releases, barman gets a build tweak, and liblerc reaches 4.3.0. You can pull it all in through dnf, though you'd be better off pointing at the specific advisory IDs rather than letting a blanket upgrade take its chances.

All updates in one table

Red Hat Enterprise Linux

Red Hat shipped 32 errata advisories this round, and if your fleet spans more than one RHEL version you'll want to clear them soon. Most lean on Important. Only one crosses into Critical: a kernel update for RHEL 9.4 Update Services for SAP Solutions (RHSA-2026:94109). That's the single fire drill this week; three others landed on Moderate.

The Moderate pile is easy to skim once the Critical headline lands, but it still has teeth. It pairs two kernel fixes (one for RHEL 9.8 EUS, one for RHEL 10.2 EUS) with a perl:5.32 patch for RHEL 8.

Several packages show up more than once, so don't treat these as 32 independent chores. Bind gets hit from multiple directions — standard bind for RHEL 8, 9, and 10 EUS, plus the versioned 9.16 and 9.18 streams. libXi appears across RHEL 8, 9, and 10. Kernel isn't a single package either, with the standard RHEL kernel, a real-time variant (kernel-rt), and an NVIDIA-branded kernel for RHEL 10 all getting fresh code.

Developer tooling rounded out the batch. Two Quarkus builds shipped (3.33.4.SP2 and 3.27.6.SP2), Apache Camel 4.18 arrived for Quarkus 3.33, and Ansible Automation Platform got separate updates for 2.5 and 2.6. A grab-bag of libraries then picked up their security patches: libxml2, ghostscript, gimp, firefox, qt5-qtbase, python-urllib3, python-jwt, freerdp, and opentelemetry-collector. OpenStack Platform 13.0 for RHEL 7 and updated Satellite 6 clients joined them.

Sort your systems by RHEL version and the patching mostly follows itself. Red Hat's CVSS base scores for each vulnerability live in the errata References section rather than in the headline, so you'll want to open any Critical or Important you're actually going to install.

Rocky Linux

Rocky Linux shipped two security updates this week, and only one of them really needs you to move fast.

The python-urllib3 patch is tagged "Important" on the severity scale, which is the classification that means you should install it before you forget about it. It targets Rocky Linux 10. Since urllib3 handles a large chunk of Python's web traffic, a fix here tends to matter more than a stray dependency, so it ranks above the second item on this list.

The perl:5.32 update is only "Moderate," but it drags in an absurd pile of Perl modules, more packages than you'd normally expect a security bump to touch. That isn't inherently bad; it just means your package manager has a longer checklist to work through. It lands on Rocky Linux 8.

Neither announcement spells out the specific CVE or what the vulnerability actually lets an attacker do, so treat the errata pages as the source of truth if you want the specifics.

SUSE Linux

SUSE shipped a fresh batch of security updates this week, spanning browsers, containers, and the Linux kernel. Most of it is routine housekeeping for openSUSE Tumbleweed, with a few rated important. If you run SUSE Linux Enterprise, two of these deserve your attention first: the kernel live patch and a rootlesskit rebuild. Firefox alone closed 77 vulnerabilities at once, which is a lot of CVE numbers to eyeball.

The Chrome family isn't far behind. The important-rated Chromium fix for openSUSE Backports handles 21 holes, and OpenEXR quietly took 17 on the chin. Everything else is smaller change sets across GraphicsMagick, rqlite, apache-arrow, ImageMagick, vllm, praat, and in-toto. rootlesskit is a bit unusual: rather than patching individual CVEs, it was simply rebuilt against the latest Go security release.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y