Today's daily Linux security roundup brings critical patches across RHEL, Debian, Ubuntu, and SUSE, with Chromium absorbing roughly twenty-five to thirty CVEs for use-after-free bugs and GPU overflows. The Go standard library saw major updates to container tools like Podman, Buildah, and Grafana, fixing runtime landmines in MIME parsing, TLS validation, and URL resolution. Kernel updates across AlmaLinux, Oracle, and RHEL carry Important ratings, though Ubuntu's ABI jump means DKMS users will need to recompile custom drivers before rebooting. FreeRDP and PHP 8.3 also caught significant hits for remote code execution and SQL injection vectors, so operators should schedule maintenance and apply these updates immediately.

Daily Linux Security Roundup: Chromium, Go Stdlib, and Kernels Dominate the Patch Ball

Major distributions shipped critical updates today. Here is what actually needs your attention.

If your server room just lit up with maintenance tickets, you are not alone. Major Linux distributions rolled out sweeping security patches today, with Chromium, the Go standard library, and the kernel taking the heaviest hits across AlmaLinux, Debian, Fedora, Oracle, Red Hat, Rocky, SUSE, and Ubuntu. The short version is straightforward. Apply these today.

I am going to walk you through what landed, where the dependencies overlap, and where you should schedule your downtime.

The Browser and Runtime Wars

Chromium grabbed the spotlight again. Fedora, Debian, and SUSE all bumped the browser to 152.0.7977.75, slapping fixes on roughly twenty-five to thirty separate CVEs. Use-after-free bugs in WebGL and WebRTC, buffer overflows in the GPU renderer, and sloppy authorization checks across navigation modules make up the bulk of the list. It is the usual browser chaos. Firefox ESR and Thunderbird joined the fray with nearly identical Mozilla patch sets, covering sandbox escapes and privilege escalation vectors. If you are still running Firefox 115 or older, you are leaving the door wide open.

The Go standard library got quietly hammered too. AlmaLinux, Oracle Linux, and Rocky Linux all shipped builds for Grafana, Buildah, Podman, and related container tools that patch MIME parsing, unencrypted HTTP/2, TLS certificate validation, and URL resolution flaws. These are not usually app-level bugs. They are runtime-level landmines waiting for a crafted request to detonate.

The kernel updates this week are where things get slightly heavier. Red Hat’s product security team flagged actual vulnerabilities that deserve a patch before the right people find them. At this point, half the CVEs in container runtimes are just upstream Go bugs getting caught in the net. The ABI jumped on Ubuntu, which is fine for standard installs but a headache for custom drivers. Not cheap in terms of downtime, though the security surface you are closing out makes it worthwhile.

Kernels and the Maintenance Window Problem

AlmaLinux 10 grabbed thirty-five security patches and five stability fixes touching seccomp, netfilter, NFS, and memory management. RHEL 7 through 10 all received Important-rated kernel advisories. Oracle Linux quietly sealed fourteen CPU vulnerabilities across multiple processor families through a microcode update. SUSE pushed twenty-nine CVE fixes into ffmpeg and twenty-four into Firefox, while openSUSE Tumbleweed handled the rest of the rolling release load.

Every single kernel package in this batch requires a reboot. RHEL and Oracle explicitly call out that the kernel packages will absolutely need a restart to actually load the new memory space. Ubuntu split its fixes between the 5.4 and 4.4 kernel families on older LTS releases, which means DKMS users will need to recompile out-of-tree modules against new headers. If you kept the standard linux-generic or linux-virtual metapackages installed, your system will handle that automatically. Manual installs will require a trip to the terminal.

Slackware and openSUSE Tumbleweed kept things quieter, but libxml2 got a necessary rebuild for out-of-bounds reads and missing overflow checks. You can pull Slackware builds directly from the official FTP mirror with upgradepkg. Nothing flashy, just the kind of quiet maintenance that stops the lights from flickering.

What Actually Matters for Your Stack

If you are managing RHEL-family systems, the priority list is straightforward. Buildah, Podman, Skopeo, and related container tools all sit behind Important severity tags. FreeRDP on AlmaLinux and Oracle Linux absorbed thirteen vulnerabilities, including remote code execution via RPC and authentication bypasses. PHP 8.3 and 8.0 both got patched for SQL injection vectors and OpenSSL memory corruption. Node.js 24.19.0 landed on Oracle with an updated c-ares library and three security fixes.

Schedule your maintenance windows. Reboot when prompted. If you are on Ubuntu Pro, enable the extended security track before running apt upgrade. Head here to pull the exact errata links if your ops team wants hard CVE scores before scheduling downtime. The long wait is over for patch day, and today's batch is exactly the kind of quiet, necessary housekeeping that keeps infrastructure from turning into a cautionary tale.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux is rolling out a fresh wave of security patches across versions 8 through 10 this week. If you are running any of the major Go-based monitoring and container tools, you are likely seeing the same handful of standard library fixes applied multiple times. Grafana, Buildah, go-fdo-client, and the grafana-pcp plugin all get patched against a familiar set of Go vulnerabilities covering MIME parsing, URL resolution, unencrypted HTTP/2, and cross-site scripting. The pattern here is less about individual app flaws and more about keeping the underlying runtime from tripping over itself.

The kernel update for AlmaLinux 10 is where you will find the actual heavy lifting. The changelog reads like a full security audit of the networking, filesystem, and memory subsystems. Thirty-five security patches land alongside five stability fixes, touching everything from seccomp and netfilter to NFS client/server handling and input drivers. The list includes a notable userfaultfd shadow stack manipulation flaw and several use-after-free bugs in USB, zram, and SMB clients. Hardware-specific adjustments round out the release for AMD systems, s390 architectures, and Intel power management.

FreeRDP takes the largest single hit, absorbing thirteen vulnerabilities that range from remote code execution via RPC and Opus audio decoding to authentication bypasses and heap corruption in RDP audio and smartcard handling. GEGL lands one but severe fix for GIMP, closing an integer overflow that previously allowed remote code execution during HDR file parsing. PipeWire gets the lightest treatment, fixing a single NULL pointer dereference in its RAOP RTSP implementation. If you are managing AlmaLinux 10 hosts, applying this batch now closes some genuinely nasty attack surfaces.

Debian GNU/Linux

Debian issued four security advisories. PCRE2 lands a single patch for Debian 12 bookworm to close a regex parsing flaw that could trigger crashes or run arbitrary code on attacker-supplied input. Chromium pulls in the bulk of the CVEs here, which is about what you expect from a browser engine that touches the entire internet. Firefox ESR and Thunderbird share enough underlying Mozilla code that they carry nearly identical patch sets, fixing sandbox escapes, privilege escalation vectors, and information leaks. Firefox accounts for eleven identifiers, while Thunderbird adds a small batch of mail-client-specific issues. Anyone running bookworm or trixie should roll these updates immediately, since regex parsers and browser cores remain standard fare for exploit developers.

Fedora Linux

Fedora pushed a fresh round of security updates for both Fedora 43 and 44, with Chromium taking center stage. The Chromium patch bumps the browser to 152.0.7977.75 and slaps fixes on 27 separate CVEs, ranging from use-after-free bugs in WebGL and WebRTC to buffer overflows in the GPU renderer and sloppy authorization checks across the file system and navigation modules. If you are running the open-source Chromium on Fedora, you will want to apply that one first. The rest of the batch targets specific dependencies: Composer gets corrected against command injection via malicious Perforce URLs and path traversal through symlinks, while tkimg pulls in libtiff 4.7.2 to close a heap buffer overflow tied to PIXARLog-compressed TIFFs. perl-DBD-Pg lands at 3.21.2 to address memory leaks and a separate CVE, rust-webbrowser bumps to 1.2.4 for a Rust security advisory fix, and memcached simply rebases to upstream 1.6.45. You can push all of this through a standard dnf upgrade or target the advisory directly if you prefer.

Oracle Linux

Oracle has pushed another round of patches for Oracle Linux, and if you are running any of the supported releases, you will want to schedule maintenance windows this week. The kernel took the largest chunk of the release cycle, but the userland stack got a meaningful refresh alongside it. FreeRDP is pulling the most weight, with thirteen patched vulnerabilities that mostly target memory handling and protocol parsing. PHP 8.3 and 8.0 both reached new security revisions, closing SQL injection vectors and fixing memory corruption in OpenSSL calls. Container operators will find buildah rebuilt to drop a dependency that was tripping up test suites, while Node.js 24.19.0 rolled in an updated c-ares library and three security fixes. Go 1.26.7 landed on Oracle Linux 8 with a half-dozen CVEs addressed, and the Go toolset shipped with an experimental FIPS debugging toggle. PipeWire wrapped up the cycle with a fix for an RTSP client allocation bug, and the microcode update quietly sealed fourteen CPU vulnerabilities across multiple processor families. You can pull everything straight from the Unbreakable Linux Network, though the kernel packages will absolutely require a reboot.

Red Hat Enterprise Linux

Red Hat just shipped a fresh round of kernel patches across its supported platforms, and if you are managing RHEL 7 through 10, your maintenance windows probably just got a little more crowded. Every advisory in this batch carries an Important security rating, which means Red Hat’s product security team flagged actual vulnerabilities that deserve a patch before the right people find them. RHEL 9 and the Extended Lifecycle Support track for RHEL 7 get the full package with bug fixes and performance tweaks layered in alongside the security work. RHEL 10 and the SAP/Telecom slice of RHEL 8.8 get a tighter security-only push. There is also a separate kernel-rt patch for the aging RHEL 7 ELS track if you are still running real-time workloads there. The exact CVE scores live in the references section of each errata, but honestly, Important means you should move this to the top of your patching queue.

Rocky Linux

Rocky Linux just published a fresh batch of security advisories, and if you are running RHEL 8 or 10, you should probably apply these before the weekend. The largest package comes through RLSA-2026:63163, which patches a long list of container tools including podman, buildah, skopeo, runc, and crun. If your infrastructure runs on standard or realtime kernels, RLSA-2026:63014 and 63013 cover the regular and kernel-rt drops for RHEL 8. Monitoring teams will spot three separate grafana-pcp advisories targeting RHEL 8, 9, and 10, plus a standalone grafana fix for RHEL 10. Buildah receives its own dedicated update for RHEL 10 as well. Every advisory carries an Important severity tag, so treat these as priority installs rather than optional housekeeping. You can pull CVSS scores directly from the errata links if your ops team wants hard numbers before you schedule downtime.

Slackware Linux

Slackware just published another security advisory, and this round covers three packages most of us rely on daily. Mozilla pushed out 140.15.0 ESR for the stable branch and 153.2.0 ESR for -current, addressing a familiar spread of memory safety and parsing flaws across both Firefox and Thunderbird. Thunderbird shares nearly all the same CVEs with its browser counterpart, plus three additional entries in the 84639-84641 range. libxml2 gets a straightforward rebuild that closes out-of-bounds reads, adds missing overflow checks to dict.c, uri.c, and valid.c, and patches integer overflow paths in xmlXPtrEvalXPtrPart and the xmlIO write callback. You can pull the builds from the official FTP mirror for either Slackware 15.0 or -current, on both i586/i686 and x86_64, and run upgradepkg as root. Nothing spectacular, just the kind of quiet maintenance that keeps the lights on.

SUSE Linux

SUSE just pushed a fresh batch of security patches across its rolling and stable tracks. The rolling openSUSE Tumbleweed takes the biggest hit, with ffmpeg clearing out 29 CVEs and Firefox ESR dropping 24 more. If you maintain a Tumbleweed install running either of those stacks, applying the update should be the first task on your list. The remaining Tumbleweed fixes target a handful of container and CLI utilities like helm3, mcphost, and opencode, most of them carrying single moderate ratings. On the enterprise side, libsoup2 and podman jump to Important status. The libsoup2 patch closes an out-of-bounds read in the multipart body parser, while podman gets rebuilt against a newer Go security release even though SUSE did not publish a matching CVE for the rebuild. The rest of the enterprise targets land on openSUSE Leap 15.4, 15.5, and 15.6, along with various SUSE Linux Enterprise 15 branches from SP5 through SP7.

Ubuntu Linux

Ubuntu shipped two kernel security patches and if you are running older LTS releases or their cloud-optimized variants, you should apply them before the next automated patch window rolls around. USN-8714-2 targets the 5.4 kernel family on Ubuntu 20.04 and 18.04, fixing flaws in the OCFS2 filesystem and SCTP networking stack. USN-8725-1 reaches further back, patching the 4.4 kernel on Ubuntu 16.04 and 14.04 with corrections for the NVIDIA Tegra memory controller, NFS daemon, Netfilter, B.A.T.M.A.N. meshing protocol, and the same OCFS2 and SCTP issues. The CVE lists overlap between the two notices, which just means Canonical split the patches across different kernel generations rather than bundling them together.

The actual fix is straightforward, but the ABI change attached to both updates will trip up anyone running out-of-tree or proprietary kernel modules. Because the version number jumped, DKMS packages and custom drivers will break until they recompile against the new headers. Your system will handle that automatically if you kept the standard linux-generic or linux-virtual metapackages installed, but manual installs will require a trip to the terminal. Keep in mind that every package listed across both notices is gated behind Ubuntu Pro, which means free tier users will need to enable a trial or subscribe before the apt repositories will yield the updated kernels. A full reboot remains necessary to actually load the new kernel memory space after apt upgrade finishes.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all