Linux distros including Fedora, Debian, Oracle, and Ubuntu released a fresh wave of security advisories, led by a Chromium update with 230 CVEs rather than just the expected kernel patches. The most elegant flaw sits in Debian's ruby-jwt, where an empty key still validates as a legitimate HMAC secret, letting attackers accept forged tokens across HS256, HS384, and HS512. Other standouts include Dovecot 2.4.5 with 17 CVEs covering RCE and authentication bypass, Oracle's ten-advisory batch that clearly had been accumulating, and Ubuntu's rclone fix that closes a remote command-execution hole.

Linux distros push a fresh wave of security updates, and Chromium's 230 CVEs make the loudest noise

Today's roundup of Linux security advisories is mostly kernels, but two stories stand out: a Chromium update with 230 vulnerabilities, and a JWT bug where an empty key still counts as a valid secret. The fixes are all out now. You just have more machines than you'd like to patch.

Kernels and browsers will always eat the biggest counts. The shape is the same distro to distro: one or two updates actually matter, and the rest rides along. Here's where you should spend your time.

Browsers, kernels, and the mail servers

Fedora leads with the number that's hardest to ignore. Chromium on Fedora 43 jumped to 153.0.8010.36, and upstream crammed 230 CVEs into that release. The IDs run from CVE-2026-87429 through CVE-2026-87658, spanning use-after-free bugs, V8 and WebGL overflows, and what feels like an endless parade of missing-authorization issues. Browsers patch these roughly weekly, so the volume is tiresome, but you still want it on disk. It's also worth remembering that Chromium's CVE counts have ballooned so much lately that "230 in a single release" barely registers anymore. A few years ago that number would've triggered an incident.

Dovecot is the one worth an actual look. Fedora 44 picked up 2.4.5, and the advisory carries 17 CVEs. Two of them are the alarming kind. CVE-2026-42007 is arbitrary code execution through a Sieve editheader use-after-free. CVE-2026-42008 is an authentication bypass via trusted proxy forwarding. SMTP smuggling rounds out the top three.

Keep in mind that Oracle Linux shipped ten advisories across versions 7 through 10, and this batch smells like it had been accumulating. The kernels dominate again. Versions 6.12.0, 5.15.0, and 5.4.17 all picked up fixes for a recurring set of networking bugs, and CVE-2026-80844 plus CVE-2026-81000 show up on nearly every branch. If you run the Unbreakable Enterprise Kernel, three of them touch your box at once.

Ubuntu's batch is the same shape, aimed at specific cloud and hardware flavors. The Raspberry Pi and NVIDIA Tegra updates both land CVE-2025-10263, where certain Arm processors finish a broadcast TLB invalidation before memory writes are globally observed. Loosely, a local attacker could write to memory after access was revoked. Not an internet trigger. But it's still the reason to reboot a Pi.

The bugs worth a second look

The most elegant one this week lives in Debian's ruby-jwt update. When the code falls back to an empty key, OpenSSL still produces a valid HMAC digest. The empty key isn't rejected, so JWT.decode happily accepts an attacker-forged token. It holds across HS256, HS384, and HS512. An empty key counting as a valid secret is a genuinely useful trick. If you happen to be an attacker, that is.

Debian also pushed a heavier fix to libevent, the event library that quietly sits under a lot of networked software. Eight holes this time, several of them HTTP header-smuggling problems where a parser and a proxy disagree about where a request actually ends. Most require a malicious request to line up first, so the blast radius is narrower than the CVE count suggests.

Slackware kept it simple. Its stunnel update reaches 5.82 on both 15.0 and -current, and the real fix is a truncated read of binary session ticket keys that happen to contain null bytes, a classic out-of-bounds read. A second patch stops an OCSP stapling failure from taking the whole daemon down.

The odd one out is Ubuntu's rclone advisory, USN-8782-1, since it's a userland tool rather than a kernel. Rclone mishandled unauthenticated calls to its remote control API, letting an attacker run arbitrary commands as whoever launched the app. That spans 26.04, 24.04, and 22.04.

Not everything is urgent across the board. Rocky Linux's two tomcat advisories sit at Moderate and lean toward the quiet-fix end, so they can wait a little. Same deal with several of Oracle's cache-poisoning fixes, where the changelog dwarfs the listed CVE count.

If you're keeping score, the moves that matter are the Debian JWT update, the Dovecot 2.4.5 upgrade, the rclone fix, and the Chromium bump on Fedora. The rest rides along on your next apt or dnf upgrade. Not sure which version lands on your box? The official advisories list exact version numbers, so matching them up is quick.

A Detailed Overview

AlmaLinux

Five Linux security advisories hit AlmaLinux's errata and the kernel one is the only thing most people need to panic about.

ALSA-2026:68507 (kernel, Important, AlmaLinux 10) carries 19 separate CVEs, which is more than you'd want to untangle by hand. Several bite in ways that actually hurt: use-after-free bugs in the ALSA timer that can escalate privileges, an out-of-bounds write in the SLIP driver tied to a race condition during MTU changes, and a use-after-free in the ath9k Wi-Fi driver that simply crashes the machine. The CVE-2024-58007 entry is the oddball, a 2024 fix swept in alongside the 2026 batch. On top of the holes, there are a handful of driver tweaks, including getting the Realtek ALC245 analog output to stop returning EBUSY and making some S32G kernel drivers link at all.

Tomcat gets split across the two current releases, both rated Moderate. AL2026:68651 (tomcat9, AL10) and AL2026:68660 (tomcat, AL9) carry the exact same eight CVEs. It's a healthy spread of "things that shouldn't be possible" problems: authentication bypasses through digest auth and bad authorization, HTTP/2 headers that never get validated, an info leak during WebSocket auth, plus a couple of case-sensitivity and URL-encoding missteps. The only real difference between the two advisories is a bug fix on the AL9 side, where Tomcat wouldn't answer clients running Java 8.

Sudo's update (AL2026:68692, Important, AL10) has a single CVE, but it's a useful one: a policy bypass that lets a permitted command launch an unauthorized program through execveat. The accompanying patch canonicalizes paths containing "..", which is basically how you'd nail down that exact hole.

perl-Net-DNS (AL2026:68786, Important, AL9) closes one DoS path: unbounded recursion set off by misplaced TSIG records. If your services do a lot of DNS lookups, this is a slow resource exhaustion waiting to happen.

Debian GNU/Linux

Debian's long-term-support team pushed two security advisories and only one of them will make you reach for a coffee.

The libevent update is the heavyweight here. It's the event notification library that quietly sits under a lot of networked software, and this patch closes eight separate holes. Several of them are HTTP header-smuggling problems: libevent's parser and a frontend proxy disagree about where a request actually ends, which is exactly the kind of gap that lets an attacker slip a second request past the front door. Others are memory safety bugs that range from denial-of-service up to arbitrary code execution—the last one tied to a heap-based out-of-bounds write when accepting a local AF_UNIX socket connection. Eight issues for a "just" event library, but most of them require a malicious request to line up first, so the blast radius is narrower than the CVE count suggests.

The ruby-jwt update is far smaller but honestly the more annoying. A single flaw means that when the code falls back to an empty key, OpenSSL still produces a valid HMAC digest. The empty key isn't rejected, so JWT.decode accepts an attacker-forged token. That's an authentication bypass, and it holds across the HS256, HS384, and HS512 algorithms. An empty key counting as a valid secret is a nice trick if you happen to be an attacker.

Fedora Linux

Fedora pushed a round of security updates, landing on both Fedora 43 and Fedora 44. If you run either release, one dnf upgrade takes care of everything listed here.

The obvious headline is Chromium. Fedora 43 moves it to 153.0.8010.36, and upstream crammed 230 CVEs into the release. The IDs run from CVE-2026-87429 through CVE-2026-87658, spanning use-after-free, buffer overflows in V8 and WebGL, and the endless parade of "missing authorization" issues. Browsers patch their way through these on a near-weekly basis, so the volume is a bit tiresome, but you still want it on disk.

Dovecot is the one worth an actual look. Fedora 44 picks up 2.4.5, and the advisory carries 17 CVEs. The alarming ones are CVE-2026-42007 (arbitrary code execution via a Sieve editheader use-after-free) and CVE-2026-42008 (authentication bypass through trusted proxy forwarding). SMTP smuggling (CVE-2026-33604) joins them at the top. The rest are mostly denials of service, which still leave a mail server happily refusing to do anything.

Firefox and NSS shipped under the same advisory on Fedora 43. Firefox reaches 156.0 while NSS follows to 3.129.0. The NSS notes read like a changelog aimed straight at crypto engineers: ML-KEM-512 support, removal of the pre-standard Kyber, and a fix for ML-KEM-1024 allowing an explicit encapsulation seed. Firefox also re-enables session restore on KDE, a small bonus if a crash ever stole your tabs.

A handful of smaller packages got targeted fixes. Evolution (3.60.2 on F44, 3.58.3 on F43) added validation for clickable preview elements in mail, closing CVE-2026-88859, which let JavaScript run through a spoofed vCard. Ruby 3.4.10-32 backports the resolv gem to 0.7.2, plugging two DNS holes: a denial of service from runaway memory growth and cache poisoning with an egress bypass via crafted hostnames. stb, the public-domain C libraries, picked up a security fix for stb_sprintf (CVE-2026-79516), a local denial of service from an out-of-bounds read. Freeciv made an appearance with a version bump to 3.2.6 and two savegame-processing CVEs. You're unlikely to be targeted over a game, but the advisory is there, so it costs you nothing to take it.

The full breakdown by package follows:

Oracle Linux

Oracle Linux delivered its usual stack of security advisories, and this batch smells like something that had been accumulating. Ten distinct advisories span Oracle Linux 7 through 10, and if you run the Unbreakable Enterprise Kernel, three of them touched your box at once.

The kernel updates eat most of the runway, and that is a fair use of attention. Versions 6.12.0, 5.15.0, and 5.4.17 all picked up fixes for a recurring set of networking bugs. Notice how CVE-2026-80844 and CVE-2026-81000 appear on nearly every kernel branch. The xfrm ah6 routing-header validation and the tun headroom bound are the usual suspects, patched wherever the code still exists. The 5.4.17 branch carries the most historical baggage, reaching back through older KVM shadow-paging and RDMA races.

Skip the kernels if you like, and there is still work to do. Firefox jumped to 140.15.0 ESR with ten referenced CVEs, which is exactly the kind of update you apply on every machine that actually opens the browser. .NET got two separate touches: 9.0 moves to SDK 9.0.121 with runtime 9.0.20, and 8.0 receives the same treatment one version down the stack, both picking up CVE-2026-58649.

The DNS and web layers got their own care. unbound on Oracle Linux 10 is catching up on a backlog of cache-poisoning and DoS fixes, while libsoup3 gets three CVEs and plain libsoup on OL8 handles one. libevent on OL9 closes out the batch with eight fixes in version 2.1.13.

Some advisories quietly bundle more fixes than their headline CVE count implies. The unbound and libsoup3 entries in particular carry change logs that dwarf the "Related CVEs" section, so treat those numbers as a floor, not the whole story.

Rocky Linux

Rocky Linux just pushed a batch of errata, and there are a fair number worth your attention before you start patching whatever catches your eye. Eleven advisories landed under the RLSA-2026 banner, spread across all three current major releases: eight, nine, and ten.

Most are tagged Important rather than Moderate. The kernel takes the biggest chunk, showing up on every distro line, alongside some usual server suspects: sudo, tomcat, and perl-Net-DNS. If you run .NET workloads, there is a 10.0 update that bundles security fixes, bug fixes, and enhancements into a single package. Not everything is a fire-drill situation though. Two tomcat advisories are only Moderate and lean toward the quiet-fix end of the spectrum, so you can probably give those a bit more breathing room.

You are probably better off sorting these by version instead of urgency, since the same package gets filed separately for eight, nine, and ten. Here is the full breakdown:

Slackware Linux

Slackware has out a security update for stunnel, the TLS tunneling daemon that tends to sit quietly in the background until it becomes the thing standing between your services and the internet. Version 5.82 lands on both Slackware 15.0 and -current with two fixes, both traced back to the same reporter, Jose A. Diaz.

The first is the one that should actually make you care. stunnel was truncating and reading past the end of binary session ticket keys whenever those keys happened to contain null bytes. That is a classic out-of-bounds read, which is the sort of memory safety hole that turns into something worse if you have the bad luck of hitting the right conditions. The second fix is simpler in spirit but more mundane in effect: an OCSP stapling response failure used to take the whole daemon down. Dead simple denial of service, and now it does not.

Neither fix is exotic, but both are the kind of thing that quietly accumulates over a long-running process, so if you run stunnel for any length of time, updating is the obvious move.

Ubuntu Linux

Ubuntu's security team pushed another wave of fixes and the bulk of it is more Linux kernel updates aimed at specific hardware and cloud flavors. Each one drags in a fresh pile of CVEs. A few are worth more attention than the rest.

The Raspberry Pi notice (USN-8726-2) and the NVIDIA Tegra update (USN-8781-1) both land the same headline bug, CVE-2025-10263. It's the one where certain Arm processors can finish a broadcast TLB invalidation before memory writes through that translation are globally observed. Loosely translated, a local attacker might be able to write to memory after access was revoked, which is a decent way to slip past memory protections or climb the privilege ladder. You can't trigger this from across the internet, but it's the reason to reboot if you run a Pi or a Tegra box.

The AWS FIPS notice (USN-8715-2) also reopens CVE-2025-27558, the WiFi mesh aggregation flaw that lets a physically nearby attacker inject packets. That one's threat model is narrow—you have to be close enough to reach the airwaves you want—so the CVE's seriousness is inflated by company a list of nearly 40 fixes riding along with it.

The remainder are the expected lineup: Azure, Azure FIPS, GCP, AWS, and Raspberry Pi real-time, plus a 16.04 LTS AWS kernel that simply refuses to retire. If you're on any of those, go ahead and patch.

USN-8782-1 is the odd one out, since it's a userland tool rather than the kernel. Rclone, the cloud-storage rsync stand-in, mishandled unauthenticated calls to its remote control API, letting an attacker run arbitrary commands as whoever launched rclone. It spans 26.04, 24.04, and 22.04.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all