Today's Linux security roundup delivers a massive wave of advisories across nearly every major distribution, driven by urgent patches for DNS cache poisoning in BIND and Unbound, authentication bypasses in libssh, and buffer overflows across gstreamer and .NET 10.0. Red Hat flags four critical updates for Keycloak 26.4.15 and 26.6.6, while SUSE pushes thirty-four vulnerabilities in rsync and splits Redis fixes across multiple supported branches. Ubuntu's August 18 release focuses on kernel ABI changes requiring module rebuilds, alongside a remote code execution flaw in c3p0-java, and Fedora 43 and 44 ship Python 3.14.7 and GitPython 3.1.59 to close CPU exhaustion and path traversal holes

Linux Security Roundup: Today's Patches Hit BIND, libssh, Keycloak, and rsync

A coordinated wave of advisories lands today. Clear a maintenance window before the month wraps up.

If your server fleet has been humming along since the last patch cycle, you will want to grab a coffee and schedule downtime. Today's Linux security roundup covers nearly every major distribution, and the common thread is unmistakable. Authentication bypasses, DNS cache poisoning, and stack overflows are still topping the threat lists. The patches span AlmaLinux to Ubuntu, with severity ratings clustering firmly in the Important and Critical categories. You are not debugging novel attack vectors here. You are closing known doors.

The threats tying the stack together

BIND and Unbound are showing up on almost every advisory table. AlmaLinux, Oracle, Rocky, and SUSE all shipped patches for cache poisoning and RRSIG validation flaws. If you run a public resolver or a recursive forwarder, the priority should be straightforward. You do not want to wait for the "Critical" column to claim it.

Keep in mind that libssh is the other recurring headline. Eleven CVEs land on AlmaLinux 10, covering GSSAPI key disclosure, stack overflows, and authentication bypasses. Oracle Linux and Rocky Linux followed suit with backported hardening that closes nearly identical attack surfaces. SSH daemons that have been idle since early 2026 should get updated now.

gstreamer plugins are taking another hit across AlmaLinux, Rocky, and Oracle. Out-of-bounds reads in the AVI demuxer, integer overflows in ASFMUX, and ADPCM decoder validation gaps round out the batch. Not exactly the most glamorous targets, but media pipelines tend to run with elevated privileges. That makes buffer handling worth a closer look.

.NET 10.0 finally has official tail support across AlmaLinux, Oracle Linux, and Rocky Linux. It took a while to appear in the distro repos, but four CVEs hitting the runtime, mostly revolving around security bypasses and information disclosure, make the wait reasonable. If your container images pin to older branches, this is a good reminder to audit your base layers.

Distribution-specific calls out

Red Hat's rollout leans on Keycloak. Four critical advisories hit both the 26.4.15 and 26.6.6 builds across operator images and base packages. If your authentication layer sits on either version, letting this sit in your backlog is a choice you will probably wish you hadn't made. The rest of the Red Hat batch skews Important, touching pipewire, OpenShift, and kernel patching for the 9.6 EUS stream. Moderate ratings for PAM and attr on RHEL 8 round out the list.

SUSE went loud with rsync. Thirty-four vulnerabilities landed in a single advisory, covering daemon escape routines, memory corruption, command injection, and authentication bypasses. Chroot escapes and symlink races mean anyone hosting public sync endpoints should treat this as a top priority. Redis got similar treatment across four advisories for the same RESTORE payload flaw. SUSE split it out by release branch to save you from guessing which track you actually run.

Ubuntu's August 18 batch focuses on kernel notices across releases from 14.04 through 26.04. There is also a patch for c3p0-java, which shipped with a remote code execution flaw tied to maliciously crafted serialized objects and JNDI references. The kernel side carries a consistent warning: every update introduces an ABI change. If you maintain out-of-tree modules or DKMS-built drivers, rebuild them after the reboot. Skip the reboot. You will be chasing load failures.

Fedora 43 and 44 pushed Python 3.12 and 3.14 to 3.14.7, plugging CPU-hogging denial-of-service holes in the HTML parser and a tarfile extraction trick that lets files wander off the filesystem. GitPython 3.1.59 swallowed sixteen GitHub Security Advisories covering path traversal and injection flaws. If you run any of these services, the upgrades are already in the repo.

A detailed overview

AlmaLinux

Debian issued another batch of security patches, splitting the load between a massive Bookworm kernel roll and a cluster of Trixie application fixes. If you are still on Debian 12, the linux-6.12 advisory is the one you will care about most. It addresses over a hundred CVEs covering privilege escalation, denial of service, and information leaks, while also folding in the standard stable kernel bug fixes from release 6.12.101. The Bookworm calibre update is narrower but equally practical: a malformed EPUB, OPF, or PDF file can trick the e-book manager into executing arbitrary Python code through its metadata reader, and this release also shuts the door on a regression from an earlier patch.

Trixie takes the lead on the application front. SPIP, the PHP publishing engine, picked up an unauthenticated remote code execution flaw that warrants an immediate install. librabbitmq closes two issues that could trigger a crash or let an attacker run code inside an AMQP client. The SRT UDP streaming library gets patched against two flaws that might enable a denial of service or allow attackers to skip encryption altogether. Swift wraps up the list with three vulnerabilities, including SSRF-driven information leaks and authorization bypasses in its S3 middleware. You should run apt update && apt full-upgrade and let the package manager handle the rest.

Fedora Linux

Fedora pushed out another round of security patches across Fedora 43 and 44, and Python took the brunt of the attention. Both releases got 3.12 and 3.14 bumped to 3.14.7, plugging a couple of CPU-hogging denial-of-service holes in the HTML parser and a tarfile extraction trick that lets files wander off the filesystem. libnfs and lemonldap-ng got tightened up against information disclosure and configuration bypasses, while GitPython swallowed sixteen GitHub Security Advisories in its 3.1.59 release. If you run any of these services on a Fedora box, the upgrades are already in the repo. Pull them in with sudo dnf upgrade --advisory plus the relevant advisory ID, and you can skip the panic when the next audit comes around.

Oracle Linux

Oracle just dropped another wave of security advisories across OL8, OL9, and OL10, and if your infrastructure leans heavily on DNS, identity services, or reverse proxies, this is the batch you should install this week. bind quietly patched six separate issues ranging from malformed response assertions to wildcard cache poisoning. unbound and 389-ds followed the same playbook, closing pre-auth injection vectors and stack overflow flaws that have been floating around since early 2026. libssh brought eleven related CVEs into the fold, mostly from backported hardening that keeps SSH daemons from tripping over themselves.

OL10 picked up .NET 10.0 with an official Oracle Linux tail, alongside a fresh curl update that corrected proxy environment detection and HTTP Negotiate connection reuse. Node.js 22 showed up on both OL8 and OL10 again, mostly wrangling dependency vulnerabilities in npm packages and sqlite. Gstreamer's "good," "bad," and "ugly" plugin families all took hits for out-of-bounds reads and integer overflows in AVI and demuxer code. PCP got a solid dose of command injection guards and new metrics, though the real story here is just keeping the monitoring stack honest. You will want to apply these before the "Important" ratings age into the "Critical" column.

Red Hat lined up another round of security advisories for RHEL, and you should clear a change window before the month wraps up. The headline here is Keycloak. Four critical updates hit both the 26.4.15 and 26.6.6 builds across operator images and base packages. If your authentication layer sits on either version, letting this sit in your backlog is a choice you will probably wish you hadn't made. The remainder of the rollout skews Important, touching pipewire, the kernel, OpenShift, gstreamer, and a string of lower profile utilities. You will spot a handful of Moderate ratings for attr, pam, and the kernel on the 9.6 EUS stream. CVSS scores are attached to each CVE reference, so pull those numbers if you need to justify the change request to your CAB. Test in your non-prod environment first, then push it out.

Rocky Linux just pushed a fresh batch of errata across versions 8, 9, and 10. Most of these land as security patches, with a few covering routine kernel maintenance and a .NET 10.0 update that bundles security fixes alongside bug reports and performance tweaks. You will notice unbound showing up three separate times across different OS versions, which usually means either the resolver is getting hammered in the wild or the team is being aggressively thorough. PostgreSQL, haproxy, pcp, libssh, and nghttp2 round out the list. If your stack runs any of these packages, running dnf update before the next maintenance window is the move.

SUSE pushed out another security batch, and the headline is rsync. Thirty-four vulnerabilities landed in a single advisory, covering daemon escape routines, memory corruption, command injection, and authentication bypasses. If you run rsync as a daemon, this is the patch you apply before your morning coffee. The memory safety bugs mostly involve chroot escapes and symlink races, which means anyone hosting public sync endpoints should treat this as a top priority.

Redis gets a similar treatment across four separate advisories. The same RESTORE payload flaw (CVE-2026-66373) affects Redis 6.2, 7.0, and 7.2. SUSE split it out so each supported branch gets its own patch, which saves you from second-guessing which release track you are actually running. All four land at Important severity.

The texlive advisory is noticeably calmer. Three memory-safety bugs in pdftex and synctex get fixed, mostly NULL pointer dereferences and a use-after-free in the SyncTeX parser. You are unlikely to trip over these unless you are feeding pdftex deliberately malformed TeX files, which is why SUSE tagged it Moderate. Python-PyPDF2 follows the same Moderate lane, closing two infinite-loop and long-run-time issues for anyone parsing untrusted PDFs.

The Tumbleweed media updates round out the cycle. Tablib, htop, and forgejo-cli each picked up a single patch for medium-severity flaws on the rolling release tracks.

Ubuntu’s August 18, 2026 security batch leans heavily on kernel patches and closes out with a single Java library fix. If you run anything from Ubuntu 14.04 through 26.04, you will want to pull these updates. The kernel notices cover a long list of CVEs touching network drivers, file systems, cryptographic APIs, IPv4/IPv6 stacks, TCP, SCTP, and architecture-specific code. Oracle Cloud and HWE kernel users get their own dedicated notices, while the legacy LTS releases (18.04, 16.04, 14.04) and any FIPS or cloud variants will require an Ubuntu Pro subscription to access.

There is also a patch for c3p0, a JDBC connection pooler that shipped with a remote code execution flaw tied to maliciously crafted serialized objects and JNDI references. The kernel side carries a consistent warning across every notice: each update introduces an ABI change. If you maintain out-of-tree modules or DKMS-built drivers, you will need to rebuild them after the next reboot. The standard metapackage upgrades happen automatically, but do not skip the reboot.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y