The major Linux distributions coordinated a massive security sweep, targeting critical flaws across OpenSSL, nginx, rsync, and kernel networking stacks. Ubuntu’s NVIDIA kernel update alone quietly stuffed roughly three hundred CVEs into a single notice, while Qubes OS closed a dangerous format-string hole in its primary qube management helper. Most advisories land at "Important" severity, meaning systems administrators should prioritize the OpenSSL and kernel bumps on AlmaLinux, Oracle, Rocky, and RHEL before touching anything else. Keep in mind that several patches overlap with earlier HollowByte advisories and new Oracle kernel signing reworks may require matching package versions to keep secure boot functional.

Linux Security Roundup: The Patch Flood Hits AlmaLinux, Debian, Fedora, and More

The major Linux distributions lined up for a coordinated security sweep, and if you run anything in production, you already know which packages need attention. OpenSSL, nginx, and rsync all picked up critical patches, Qubes OS found a format-string hole in its main qube helper, and Ubuntu's NVIDIA kernel update quietly stuffed roughly three hundred CVEs into a single notice.

The maintenance windows are open. Most of these land at "Important" severity, which is sysadmin shorthand for schedule a maintenance window or lose sleep. The common thread this round is infrastructure tooling and kernel networking stacks taking heavy hits.

The Heavy Hitters

AlmaLinux shipped a massive batch that starts with OpenSSL. Nine CVEs hit both AlmaLinux 9 and 10, led by a QUIC packet double-free and a memory-growth denial of service. There is also a note about the HollowByte DoS fix potentially needing a backport, meaning you might patch the same hole twice if your version tracking is loose. nginx rounds out the top priority with CVE-2026-42533, an arbitrary code execution flaw over crafted HTTP requests that shows up across stock releases and the 1.24 branch. rsync follows with roughly twenty CVEs covering command injection, path traversal, and a TLS certificate validation bypass. The EL10 build also rebase jumps to version 3.5.0.

Debian's round is shorter but genuinely nasty. The urwid web display backend builds session IDs by chaining two calls to Python's Mersenne Twister PRNG, then drops that predictable string as a filename into /tmp. Any local user can enumerate active tokens, read your terminal, or flood the FIFO to crash the session. It is a glaring design flaw for something handling authentication. cjose gets two CVEs for potential DoS and plaintext recovery, though the urwid gap is the one to close first on shared hosts.

Kernels and Enterprise Stacks

Oracle Linux and Rocky Linux both pushed kernel updates that demand a reboot. OL8's 4.18.0-553.162.1 and OL9's 5.14.0-687.47.1 pull in backported fixes across the entire networking stack, Bluetooth, and GPU drivers. Oracle's OL10 kernel only closes a single bridge fast-leave hole, so read that as housekeeping rather than an emergency. Watch the module signing chain carefully though. They reworked the whole Oracle Linux Driver Signing key and disabled UKI and aarch64 signing in places, so mismatched package versions will break secure boot.

RHEL followed with 28 advisories, almost all rated Important. The OpenShift cluster got simultaneous treatment across 4.20.38, 4.21.33, and 4.22.14, so you get a choice depending on which minor line you actually run. Kernel-rt landed for the SAP crowd, .NET 8.0, 9.0, and 10.0 all got patched, and two advisories cover the same JBoss 7.4.25 build. It is a little redundant for legacy software, but not unexpected.

Qubes OS found a format-string bug in qvm-open-in-vm that could let an attacker execute code in your active qube if a filename chain aligns just right. The exploit chain is long. You need an attacker-controlled path over 248 bytes, printf-style specifiers, and the Debian templates shipped without _FORTIFY_SOURCE hardening. The Fedora templates build correctly and would have aborted safely. The fix is just qubes-core-agent 4.3.48, and it is about as painless as these get.

Ubuntu and SUSE

Ubuntu's USN-8760-1 covers the NVIDIA kernel on 24.04 LTS and quietly stuffed roughly three hundred vulnerabilities into a single notice. Networking, storage, USB, filesystems, audio, and GPU drivers all got hit. The Azure kernels got the same broad treatment, with USN-8761-1 for 24.04 and USN-8730-2 for 22.04. Both carry the familiar ABI-change warning for third-party kernel modules, so NVIDIA drivers are the usual offender you will need to recompile.

SUSE kept things familiar with kernel live patches for CVE-2026-64423 and CVE-2026-68138 across SLE 15 SP4, SP5, and SP7. libpcap ate the biggest chunk of the blast radius with seven issues in the BPF interpreter, peaking at an 8.8 for an out-of-bounds read. hauler on openSUSE Leap 16.0 earned a critical rating for seven CVEs, which is a touch more urgency than a Go tool usually warrants, though the gRPC and crypto/ssh flaws behind it are legitimate.

Head here to the AlmaLinux errata tracker, the Debian security list, and the Ubuntu USN archive for full advisory IDs and installation commands. If you haven't run your package manager yet, OpenSSL, nginx, and the kernel updates on AlmaLinux, Oracle, Rocky, and RHEL are the ones that actually demand a reboot. Qubes users need to migrate qubes-core-agent 4.3.48 from security-testing to stable, and Ubuntu Pro users will find plenty of Extended Security Maintenance fixes behind the paywall. Keep in mind that several of these OpenSSL and rsync patches overlap with earlier HollowByte advisories, so double-check your version numbers before you declare victory.

The Updates in Detail

AlmaLinux

AlmaLinux pushed a wide batch of errata Friday, Sept. 15. OpenSSL, nginx, and rsync all picked up the kind of vulnerabilities that get sysadmins to hit patch without finishing the email. If any of these packages sit under you, it is worth a look.

OpenSSL brings its usual deluge. Nine CVEs land on both AlmaLinux 9 and 10, with a double-free on QUIC's INITIAL packet and a memory-growth denial of service leading the list. The description reads a bit like a checklist of things a large crypto library keeps tripping over. There is also a flag that a HollowByte DoS fix may have slipped out on an earlier release, meaning you could be patching the same hole twice.

nginx is the one worth circling. CVE-2026-42533 is arbitrary code execution over crafted HTTP requests, and it shows up across three releases, stock and the 1.24 branch. A remote code-exec flaw in a web server that probably fronts your stuff is the kind of thing you would rather fix this morning.

rsync gets its own mountain. It is a little over 20 CVEs on the AlmaLinux 9 build and 21 on the AlmaLinux 10 build, covering command injection, arbitrary file write, path traversal, and a TLS certificate validation bypass that lets someone intercept an encrypted session. The AlmaLinux 10 branch also rebases rsync to 3.5.0, so you get the version bump along with the patches.

The rest is more routine. Go tooling inside osbuild-composer picks up ten denial-of-service fixes through sloppy parsing, Rust and libgit2 take one DoS hit, the kernel hardens 11 points on the regular build and 12 in the real-time version, perl fixes its oversized-regex bug, and Python's Tornado absorbs two flaws. Nothing here is novel, but the volume argues for one maintenance window instead of a trickle of logins.

Debian GNU/Linux

Two Debian security advisories landed on September 15, 2026 (DLA-4780-1 for urwid, DSA-6499-1 for cjose), and together they make a decent case for finally running those package upgrades you've been skipping.

The urwid advisory is the more entertaining one. Its web display backend builds session IDs by chaining two calls to random.randrange(10**9), both riding on Python's Mersenne Twister PRNG, which was never built for anything resembling security. Even worse, that same random string doubles as the filename for a FIFO file dropped into /tmp, a directory any local user is free to browse. That lets anyone on the host enumerate active session tokens just by poking at /tmp. Hand an attacker a valid session ID and they can read the victim's terminal screen through the polling endpoint, type keystrokes into the session, or flood the FIFO to crash it completely. It's a rather glaring design flaw for something handling authentication. Fixed in 2.1.2-4+deb12u1 for Debian 12 bookworm.

Then there's cjose, a C library implementing the JOSE standard. Two bugs here could lead to denial of service, arbitrary code execution, or plaintext recovery, depending on how you've configured it. They show up as CVE-2026-53938 and CVE-2026-53939. Debian fixed those in 0.6.2.3-1+deb13u1 for trixie, the stable release.

If you run either package on a shared host, the urwid gap is probably the one to close first. Local /tmp enumeration is no remote zero-day, but the fallout—someone reading your terminal or injecting commands into your session—is concrete. Upgrade both while you're in there.

Fedora Linux

Fedora issued a batch of security advisories, spanning both Fedora 43 and Fedora 44. The same packages mostly rolled out to both releases, so you get the same patchwork of fixes whether you run the older or newer version. Coverage runs from memory-safety glitches and temp-file tricks to a replay attack and some DNS weirdness.

A few details are worth a look. python-configargparse got its security fix on September 6, then a bug fix the following day, giving you two releases inside a single 24-hour window. erlang, which powers a good chunk of Ericsson's telecom gear, picked up backported fixes across three CVEs. perl-Authen-SASL's fix was traced to an AI-assisted detection tool, which is a welcome change from the usual hand-reviewed audit. sblim-sfcb, described in its own writeup as low-resource and built for constrained environments, needed hardening against an out-of-bounds read and a symlink attack inside a temporary file. ruby and rubygems share one story, since both shipped a bundled resolv bump to 0.7.2 to close two DNS-related CVEs. knot kept things deliberately terse, noting only that its XDP, DDNS, and TSIG paths got secured, with no individual CVE spelled out in the advisory.

Oracle Linux

Oracle Linux issued 23 security advisories this round, spread across OL 8, OL 9, and OL 10. Look at the list long enough and it starts to blur, mostly because the same packages get reissued under different major versions. The real priority is the kernels. OL 8's 4.18.0-553.162.1 and OL 9's 5.14.0-687.47.1 pull in backported fixes across the whole networking stack (sctp, tipc, netfilter, the qdisc chain), Bluetooth, Wi-Fi, and the AMD and Intel GPU drivers. If you've been postponing a reboot, those two are your excuse. The OL 10 kernel (6.12.0-211.54.1) only closes a single bridge fast-leave hole, so read that as housekeeping rather than an emergency.

openssl earns its usual multi-CVE pass on both OL 9 and OL 10, rebasing to 3.5.8 and bolting on the "HollowByte" hardening patch. firefox climbs to 140.15.0 ESR on OL 9 and OL 10, and OL 10 picks up a fresh postgresql18 at 18.6 with nearly a dozen CVEs hanging off the release. nginx shows up three times across the versions. Then the oddball set: libkcapi (a crypto-API wrapper) absorbed the same trio of CVEs on all three major versions, git-lfs got a Golang rebuild that quietly shuts three CVEs without fanfare, perl-YAML-Syck took down four memory-safety holes in one afternoon, and python-tornado moved to 6.5.8. osbuild-composer on OL 10 lumps six CVEs into a single package, the kind of one-shot you'd gladly apply without reading further. Watch the kernels' signing, though: they rework the whole chain (new Oracle Linux Driver Signing key, UKI and aarch64 signing disabled in places), so if secure boot or module signing matters to you, make sure the package versions actually line up with what's running before you restart.

Qubes OS

The Qubes team just issued QSB-119, covering a format-string bug in qvm-open-in-vm, the helper that ships a file into another qube for editing. If you point it at a file with an attacker-controlled name or path, and a chain of conditions lines up, an attacker might end up executing code in whatever qube you called the tool from. That's not the usual "your isolated qube got pwned across a hard security boundary" story, but controlling a qube from a filename is still the kind of thing you don't want to gamble on.

The good news is the fix is about as painless as these get. Just update normally. Only Debian-based templates and standalones are affected among the official Qubes templates, and that's largely Qubes's own fault. The flaw only works because the Debian packages shipped without _FORTIFY_SOURCE hardening enabled, a side effect of a mismatch between the Qubes build script and the way Debian handles that option. The Fedora packages built correctly and would have aborted safely instead of letting the bug run. The fix, qubes-core-agent 4.3.48, simply turns that hardening back on.

The exploit has a long checklist: a filename over 248 bytes or a non-writable directory, printf-style specifiers like %n in the path, no --view-only flag, the target qube returning the file content, and the missing hardening all have to hold. The first person who tried to shake it down managed a working exploit in under 3% of attempts, and that demo needed a painfully long, heavily nested path. In the real world, attackers usually control only the tail end of a filename, and most people would balk at such a path anyway. The bar is high. Take the update anyway.

Red Hat Enterprise Linux

Red Hat closed out its latest patch window with 28 security advisories, and if you run anything on RHEL you may want to eyeball the list before treating the weekend as safe. Almost everything lands at "Important" severity, 23 of them exactly, with four "Moderate" and a single "Low." That split means you are looking at real, likely-exploitable flaws rather than the cosmetic fixes you can quietly schedule for next quarter.

The OpenShift cluster is the busiest part of the batch: 4.20.38, 4.21.33, and 4.22.14 all got simultaneous treatment, so you get a choice depending on which minor line you actually run. Kernel updates show up for RHEL 8, 9, and 10, with a separate real-time build aimed at the SAP crowd (kernel-rt, US4S). .NET gets three versions patched, grafana appears twice across EUS channels, and rsyslog, firewalld, leapp-repository, and goose round out the system-level fixes. If you still host anything on JBoss 7.4, two advisories cover the same 7.4.25 build, which is a little odd but not surprising for legacy software.

One non-update slipped into the pile. Justin Wheeler, a Red Hat staffer calling himself "AI Alignment Community Architect" for Fedora, published a lengthy explainer on what the job actually means. He is essentially mediating a turf war inside open source between two camps: those who think AI tooling is useful and those who think it is a menace. His pitch is that communities should get a real say in how AI models are built to touch them instead of just being told to adopt them. Not a patch, but it tells you where Red Hat's people head sits on the LLM-gen-AI argument Fedora has been fighting over.

Rocky Linux

Rocky Linux just pushed 26 security advisories across its three supported releases, and most of them come stamped "Important." On the newer major versions the packages you'll actually notice are OpenSSL, the kernel, PostgreSQL, nginx and Rust. If you're still on the older line, a Perl toolkit refresh is what's waiting for you.

The ones that ask for a maintenance window rather than a quiet background patch are the EL9 kernel update (RLSA-2026:67150) and the two OpenSSL bumps, one for EL9 and one for EL10. Rust on EL10 carries the same Important rating, as does nginx.

Several threads run through the batch. libkcapi got three separate updates, one per major version, so every extra OS you maintain is another box to tick. The EL9 PostgreSQL 16 advisory (RLSA-2026:67491) ships a long module list, pgvector, pg_repack, pgaudit and a few others, meaning you update a stack, not one tidy package. The EL8 perl:5.32 advisory (RLSA-2026:67278) is the showoff: it names a couple hundred Perl modules, so treat it as a whole-toolkit job rather than a single security fix.

Severity here leans toward urgency, with the majority flagged Important and each one carrying its own CVSS score off the CVE list. Work through the Important calls first, and keep the Moderate perl updates on your radar only if your tooling leans on them.

SUSE Linux

SUSE pushed a wall of security bulletins, and most of it lands in the same spots you already patch: kernel live patches for SUSE Linux Enterprise and libpcap spread across a half-dozen products. The one that stops you mid-scroll is hauler on openSUSE Leap 16.0 earning a "critical" rating for seven CVEs, which is a touch more urgency than a Go tool usually warrants. The gRPC and crypto/ssh flaws behind it are legitimate, though.

The familiar kernel pair—CVE-2026-64423 and CVE-2026-68138—shows up again this cycle. SUSE shipped three live patches for them: Live Patch 20 for SLE 15 SP7, Live Patch 44 for SP5, and Live Patch 58 for SP4. They're hash-table and queue-management bugs in igmp and net/sched, so if you run anything network-heavy worth protecting, both are worth clearing off your list.

libpcap ate the biggest chunk of the blast radius. Two separate bulletins (4194 for SLE 15 SP6, 4195 for SP4/SP5 and the Micro family) each close seven issues in the BPF interpreter and rpcap client, peaking at an 8.8 for the out-of-bounds read in CVE-2026-0799. If packet capture runs on any of those, treat both as mandatory rather than optional.

The rest of the enterprise spread rounds out with python-GitPython, where one of three CVEs lets pre-commit hooks fire arbitrary code, and a 389-ds stack address leak that rounds out the important-to-moderate range. Python 3.10 absorbs four smaller wheel- and pip-related fixes on top of a couple of non-security regressions.

Tumbleweed gets its usual GA-media grab bag: gimp carries nine CVEs, docker, syncthing, zstd-jni and the rest pick up one or two each, and there's a standalone hauler patch plus bson-devel sitting in there too. If you're building from installed Tumbleweed media, skim the full list before assuming you're covered.

Ubuntu Linux

Ubuntu put out a fresh batch of security notices, and if you're on Azure or NVIDIA-powered Ubuntu boxes, you've got more than the usual amount of patching ahead of you.

The obvious headline is USN-8760-1, the kernel update for NVIDIA systems on Ubuntu 24.04 LTS. The affected subsystems read like a roll call of the whole kernel—networking, storage, USB, filesystems, audio, GPU drivers, Bluetooth, you name it. The CVE list runs from CVE-2026-52908 through CVE-2026-80591, which lands at somewhere around three hundred-plus vulnerabilities in a single notice. It's the kind of thing that makes you appreciate having a weekend open.

The Azure kernels got the same broad treatment across both supported LTS lines. USN-8761-1 covers 24.04 with a wide spread of fixes, while USN-8730-2 is a smaller one-off aimed at 22.04 that only touches IPv6 networking and Netfilter. Both carry the familiar ABI-change warning, which is Ubuntu-speak for "if you have third-party kernel modules installed, recompile and reinstall them, then reboot." Nvidia drivers are the usual offender here.

The rest is application-level housekeeping with a fairly standard spread of old favorites. SQL injection turns up in both python-sql and Shibboleth's ODBC storage plugin. phpseclib lets a remote attacker run a padding oracle timing attack against AES-CBC to leak secrets. SRT has two holes that let someone downgrade an encrypted stream or trip the library into crashing. Terminals aren't off the hook either: kitty carries four issues spanning command execution to file overwrite, and Snapcast's JSON-RPC handling opens the same door. Polkit can be made to crash or run things as root, Suricata-Update will write files wherever a crafted rule archive points it, and ImageMagick's usual problem with malicious images shows back up as denial of service and remote code execution.

A couple of things to keep straight. A big share of these fixes sit behind Ubuntu Pro's Extended Security Maintenance, so if you've ever hit that "Available with Ubuntu Pro" line you know what I mean. The oldest releases here—16.04, 18.04—are well past their prime but still covered for several of these. Every kernel notice above also wants a reboot once you finish.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y