Mid-September 2026 shipped another heavy wave of security errata, led by Critical updates for SUSE's libzypp package manager and AlmaLinux's 389 Directory Server. Ubuntu posted the day's largest haul, closing roughly fifteen FFmpeg parsing flaws and a twenty-seven CVE NVIDIA kernel bump, while Debian and Fedora patched curl, Ruby Rack, and a 158-vulnerability Linux 6.1 kernel. Red Hat, Oracle Linux, and Rocky Linux kept the foundational stack and container runtimes locked down across RHEL and Oracle tracks 8 through 10, and Fedora 44 plugged a native CA trust validation bypass alongside HTTP/2 and proxy password fixes. Run your distro's standard update commands before the weekend, and keep in mind that Ubuntu's NVIDIA kernel ABI change will require a full reboot until you rebuild any unsigned third-party modules.
Daily Linux Security Roundup: Critical Patches Land Across SUSE, AlmaLinux, and Ubuntu
From directory server flaws to massive FFmpeg parsing bugs, the enterprise Linux stack is getting locked down.
Mid-September 2026 shipped another heavy wave of security errata, and if you manage a mixed fleet, you probably already watched your patch queue spike. Today's headlines are a Critical update for SUSE's libzypp and zypper, a matching Critical for AlmaLinux's 389 Directory Server, and roughly fifteen FFmpeg parsing flaws patched in Ubuntu. Here is what actually shipped today, and where it matters most.
The foundational stack is getting locked down across every major distro. Kernel builds for AlmaLinux 9 picked up twenty-eight security patches, tackling use-after-free bugs in smc and pNFS alongside a userfaultfd shadow stack manipulation that could open the door to arbitrary code execution. Red Hat followed the same playbook, bundling kernel and kernel-rt updates for RHEL 8 with the usual Important severity rating. That is Red Hat's standard way of saying "apply this, but save the emergency hotline call for something else."
The Directory and Service Layer
AlmaLinux made five 389 Directory Server vulnerabilities jump straight to Critical status. The SASL PLAIN authentication flaw hands privilege escalation directly to the Directory Manager, and a pre-authentication NULL pointer dereference rounds out the obvious attack surface. If you run LDAP services on AlmaLinux 9, this belongs at the top of the queue. SUSE landed its own Critical patch for libzypp and zypper, tightening GPG key validation and repository caching in the face of legacy cache invalidation issues.
The rest of the service layer kept patchers busy. OpenTelemetry collectors for both AlmaLinux 9 and 10 absorbed Go ecosystem hits to neutralize denial-of-service and cross-site scripting flaws. Valkey on AlmaLinux 10 hit a full rebase to version 8.0.10, bringing three remote code execution fixes tied to stream deserialization and TLS processing. SUSE's tomcat11 refresh is another heavyweight, addressing eleven vulnerabilities that range from authentication bypasses to WebSocket session leaks.
The Userland and Kernel Push
Ubuntu shipped its biggest haul on September 10, closing roughly fifteen separate FFmpeg parsing flaws across HEVC, NVDEC, and DASH streams. The kernel side is even heavier. The NVIDIA kernel bump for Ubuntu 24.04 patches twenty-seven CVEs across networking, filesystems, and drivers. You will need to reboot, and any unsigned third-party modules you compiled yourself will have to be rebuilt after the ABI change.
Fedora gave curl three fixes for HTTP/2 use-after-free issues and a lingering proxy password leak on Fedora 43. Fedora 44's curl went a step further and plugged a native CA trust validation bypass. Debian paired a 158-vulnerability patch for the aging Linux 6.1 kernel on stretch, buster, and bullseye with twelve CVEs in Ruby's Rack framework for trixie. Queue both upgrades if you run Ruby-based web services.
A few oddities made the lists. Vim on AlmaLinux 8 took seven fixes, including heap overflows and netrw menu entries that execute code. It is a text editor. You would expect better. SUSE's rolling Tumbleweed stream quietly dropped thirty-eight Chromium vulnerabilities in a single chromedriver bump, while Red Hat shipped patches for OpenShift 4.16.70 and OpenStack 17.1.
It is a lot to digest before the weekend. Head here to your distribution's advisory page and run your standard update commands. AlmaLinux and Rocky users can pull patches through yum update or dnf update. SUSE and openSUSE users should stick to zypper patch, while Ubuntu and Debian admins will rely on apt upgrade and your usual package manager respectively. Keep in mind that the NVIDIA kernel ABI change on Ubuntu requires a full reboot, and unsigned third-party modules will break until you rebuild them. Apply the patches, verify the versions, and try not to get buried under the advisory tables.
The Updates in Detail
AlmaLinux
AlmaLinux shipped a heavy batch of security errata this week, and the patch notes read like a checklist of things system administrators have been staring at since lunch. The standout is the Critical update for 389 Directory Server on AlmaLinux 9. Five vulnerabilities make the jump to Critical status, including a SASL PLAIN authentication flaw that hands privilege escalation straight to the Directory Manager, plus a pre-authentication NULL pointer dereference. If you run LDAP services on 9, this one belongs at the top of the queue.
The kernel updates dominate the list. The Alma Linux 9 non-RT kernel gets a serious overhaul with 28 security patches, tackling use-after-free issues in smc and pNFS, a remote out-of-bounds write in RDMA/siw, and a userfaultfd shadow stack manipulation that opens the door for arbitrary code execution. Two bug fixes round out the package, including a TPM that locks up the system and a real-time scheduler livelock. The Alma Linux 8 kernel and kernel-rt builds share a smaller set of fixes, mostly tightening up netfilter, sctp, and SCSI driver handling.
Virtualization and cloud tooling did not escape either. osbuild-composer on Alma Linux 8 absorbs ten Go ecosystem patches, and OpenTelemetry collectors for both Alma Linux 9 and 10 take similar hits to neutralize denial-of-service and cross-site scripting flaws. Valkey on Alma Linux 10 lands a rebase to 8.0.10 alongside three remote code execution fixes tied to stream deserialization and TLS processing. If you pull roles with ansible-galaxy on Alma Linux 8, you will want to patch the argument injection flaw that leads to arbitrary code execution before someone feeds it a malicious URL.
A few oddities are worth noting. Vim on Alma Linux 8 gets seven fixes, including heap overflows and netrw menu entries that execute code. It is a text editor. You would expect better. The gzip update on Alma Linux 8 handles a couple of memory safety issues in gzexe and LZH decompression, while apr-util takes four patches for heap overflows in its Redis and Memcached clients. Python 3.12 and base lxml packages on Alma Linux 9 share a URL bypass vulnerability that sneaks through the Cleaner via a missing xlink:href attribute. Perl DBI on Alma Linux 9 and 10 picks up a follow-up patch for a previously incomplete arbitrary code execution fix.
| Errata ID | Package | AlmaLinux Version | Severity | Release Date | Key Fixes & Notes |
|---|---|---|---|---|---|
| ALSA-2026:66000 | kernel | 8 | Important | 2026-09-10 | Seven patches covering pcrypt backlog handling, conntrack sprintf removal, synproxy tcphdr refresh, rhashtable stale iteration, SMB DFS validation, nvmet-rdma inline data, and bridge fast-leave stop. |
| ALSA-2026:66324 | kernel-rt | 8 | Important | 2026-09-10 | Fifteen security patches targeting qla2xxx, sctp, tipc, and ixgbevf. Includes bug fixes for mpt3sas PCIe buffer freeing and gfs2 glock hardening. |
| ALSA-2026:66016 | osbuild-composer | 8 | Important | 2026-09-10 | Ten Go ecosystem patches covering FIPS buffer zeroing, HTTP header leakage, IDNA privilege escalation, and multiple DoS/XSS flaws. |
| ALSA-2026:66248 | ansible-core | 8 | Important | 2026-09-10 | Fixes argument injection in ansible-galaxy role install that allows arbitrary code execution. |
| ALSA-2026:65897 | qt5-qtbase | 8 | Important | 2026-09-09 | Single fix for a DoS caused by an out-of-bounds read in text codec handling. |
| ALSA-2026:66325 | kernel | 8 | Important | 2026-09-10 | Shares the 15 security patches and 2 bug fixes from the kernel-rt build (ALSA-2026:66324). |
| ALSA-2026:65998 | gzip | 8 | Moderate | 2026-09-10 | Patches insecure temporary file handling in gzexe (file overwrite) and a global buffer overflow in LZH decompression. |
| ALSA-2026:66203 | python3.12-lxml | 9 | Important | 2026-09-10 | Fixes a URL bypass vulnerability in the Cleaner module triggered by a missing xlink:href attribute. |
| ALSA-2026:66204 | python-lxml | 9 | Important | 2026-09-10 | Delivers the same lxml Cleaner URL bypass fix as the 3.12 variant. |
| ALSA-2026:63129 | kernel | 9 | Important | 2026-09-10 | Massive rollout of 28 security patches. Covers use-after-free in smc/pNFS/exfat, remote OOB write in RDMA/siw, userfaultfd RCE, and locking/rt RCU protection. Adds TPM unresponsiveness and RT scheduler livelock fixes. |
| ALSA-2026:64784 | 389-ds-base | 9 | Critical | 2026-09-10 | Five vulnerabilities patched, including a SASL PLAIN auth privilege escalation, pre-auth NULL pointer dereference, and an anonymous LDAP client defeating SELFDN ACI checks. Includes two replication fixes. |
| ALSA-2026:65117 | opentelemetry-collector | 9 | Important | 2026-09-09 | Mirrors the Go ecosystem patch set seen in osbuild-composer, neutralizing DoS, XSS, and TLS KeyUpdate flaws. |
| ALSA-2026:66348 | vim | 8 | Important | 2026-09-10 | Seven fixes targeting heap overflows, crafted vimball execution, netrw menu RCE, and terminal out-of-bounds writes. |
| ALSA-2026:64796 | valkey | 10 | Important | 2026-09-10 | Three RCE patches for RESTORE payload handling, stream deserialization UAF, and TLS pending-data UAF. Rebases to 8.0.10. |
| ALSA-2026:65116 | opentelemetry-collector | 10 | Important | 2026-09-09 | Identical Go ecosystem patch set as the AlmaLinux 9 build. |
| ALSA-2026:65887 | perl-DBI | 10 | Important | 2026-09-09 | Follow-up patch for an incomplete fix to an arbitrary code execution flaw via a caller-influenced Profile attribute. |
| ALSA-2026:65606 | gpsd-minimal | 9 | Important | 2026-09-10 | Fixes arbitrary OS command execution via code injection in the gpsprof utility. |
| ALSA-2026:65993 | qt5-qtbase | 9 | Important | 2026-09-10 | Same text codec out-of-bounds read DoS fix as the AlmaLinux 8 build. |
| ALSA-2026:66179 | perl-DBI | 9 | Important | 2026-09-10 | Same incomplete fix follow-up as the AlmaLinux 10 build. |
| ALSA-2026:65816 | qt6-qt5compat | 10 | Important | 2026-09-10 | Applies the same text codec out-of-bounds read DoS patch to the Qt 5 compatibility layer. |
| ALSA-2026:66341 | apr-util | 9 | Moderate | 2026-09-10 | Four patches targeting heap overflows in Redis and Memcached clients, a password validation timing attack, and an XML stack recursion DoS. |
Debian GNU/Linux
FreeXian released ELA-1821-1 to patch the Linux 6.1 kernel across Debian stretch, buster, and bullseye. The advisory closes 158 vulnerabilities spanning from 2023 through 2026. The flaws open doors for privilege escalation, denial of service, and information leaks. The kernel is aging, but a patch list of that length tells you the maintainers finally did their homework.
Debian paired that release with DSA-6492-1 for ruby-rack on trixie. Twelve CVEs were addressed in version 3.1.20-0+deb13u2. Attackers could have used these bugs to trigger service outages, expose sensitive data, spoof requests, or slip past access controls. Queue that upgrade alongside the kernel patch if you run Ruby-based web services.
Both advisories target infrastructure that handles sensitive requests. Apply the patches when your maintenance window opens, and verify the new package versions match your distribution branch.
| Advisory | Package | Affected Distro / Branch | CVEs Addressed | Primary Risks | Patch Version |
|---|---|---|---|---|---|
| ELA-1821-1 | linux-6.1 | stretch, buster, bullseye (Extended LTS) | 158 (2023-2026) | Privilege escalation, DoS, information leaks | 6.1.187-1deb9u1 / 6.1.187-1deb10u1 / 6.1.187-1~deb11u1 |
| DSA-6492-1 | ruby-rack | trixie (stable) | 12 (2026) | DoS, info disclosure, spoofing, access bypass | 3.1.20-0+deb13u2 |
Fedora Linux
Fedora shipped a fresh wave of security patches for both Fedora 43 and 44. The curl package gets the broadest coverage, picking up three fixes for a use-after-free in HTTP/2, a lingering proxy password leak, and a sneaky connection reuse bug. Fedora 44's curl goes one step further and also plugs a native CA trust validation bypass. libevent absorbs the heaviest load with eight separate CVEs, mostly cleaning up HTTP parser flaws, header smuggling vectors, memory corruption, and authorization bypasses. Corosync rounds out its cluster messaging code with patches for an integer overflow and a heap buffer overflow during message reassembly. The DokuWiki and GNOME rest packages each get single backported fixes targeting an RCE object injection and weak randomness in authentication, respectively. grpcurl gets bumped to 1.9.4, which addresses a denial-of-service quirk tied to DNS SAN parsing, while BlueZ takes a full upstream rebase that closes a couple of AVRCP stack overflows. You can push these changes through dnf update on whichever release you are running.
| Package | Release | Version | CVEs Addressed | What actually gets fixed |
|---|---|---|---|---|
| curl | Fedora 43 | 8.15.0-10 | CVE-2026-10536, CVE-2026-9079, CVE-2026-8458 | Patches an HTTP/2 stream dependency use-after-free, a stale proxy password leak, and a logical connection reuse error. |
| curl | Fedora 44 | 8.18.0-10 | CVE-2026-10536, CVE-2026-11564, CVE-2026-9079, CVE-2026-8458 | Same trio as F43 plus a certificate validation bypass in native CA trust handling. |
| libevent | Fedora 43 | 2.1.13-1 | 8 CVEs (63383, 63384, 63379, 63381, 63382, 63385, 63387, 63388) | Resolves multiple HTTP parser bugs, header smuggling risks, use-after-free memory corruption, and authorization bypass flaws. |
| corosync | Fedora 43 | 3.1.10-3 | CVE-2026-81666, CVE-2026-81665 | Fixes an integer overflow in commit token validation and a heap buffer overflow during fragmented message reassembly. |
| dokuwiki | Fedora 43 & 44 | 20250514b-6 / 20250514b-8 | Object injection RCE | Backports a PHP object injection patch that prevents remote code execution. |
| grpcurl | Fedora 43 & 44 | 1.9.4-1 | CVE-2026-27145 | Bumps the tool to 1.9.4, closing a denial of service vulnerability caused by excessive DNS SAN processing. |
| rest | Fedora 43 & 44 | 0.10.2-5 / 0.10.2-9 | CVE-2026-16615 | Strengthens weak random number generation inside the PKCE authentication flow. |
| bluez | Fedora 44 | 5.87+1.git... | CVE-2026-85218, unlisted OOB read | Rebases to upstream HEAD to patch AVRCP stack overflows and an out-of-bounds read in media element parsing. |
Oracle Linux
Oracle Linux is rolling out another batch of errata across its track, and if you manage environments anywhere from OL7 to OL10, it is time to run your update scripts. Security advisories dominate the list. Thunderbird ships an ESR bump that patches 25 CVEs, and perl-DBI closes a string of stack, heap, and unsafe eval vulnerabilities across four CVE IDs. The out-of-bounds read in QTextCodec shows up repeatedly, landing in qt5-qtbase for OL8 and OL9, plus qt6-qt5compat on OL10. OL7 finally gets a urllib3 patch for CVE-2025-66471 and a gstreamer1-plugins-bad-free update that tackles two 2026 CVEs. The OL8 systemd rebuild is exactly the kind of sprawling changelog you expect from a base system package, but the practical wins include disabling unprivileged BPF by default, a cleanup pass on devlink device units, and a few podman quadlet workarounds that should keep containerized workloads from tripping over themselves. OL10's sysstat update finally makes sar report actual CPU numbers instead of zeros, and if you run dnsmasq, both the OL8 and OL9 packages refresh their DNSSEC trust anchors with the 2024 key.
| Package | OS Version | Updated Version | Key Fix |
|---|---|---|---|
| python-urllib3 | OL 7 | 1.10.2-7.0.3.el7 | CVE-2025-66471 backport |
| gstreamer1-plugins-bad-free | OL 7 | 1.10.4-4.0.5.el7_9 | CVE-2026-59691, CVE-2026-59692 patches |
| xdg-desktop-portal | OL 8 | 1.12.6-2.0.1.el8_10 | Fuse session segfault fix, drops flatpak Recommends |
| systemd | OL 8 | 239-82.0.13.el8_10.19 | Devlink cleanup, mount state fixes, disables unprivileged BPF, podman quadlet workarounds, CVE-2025-4598 |
| dnsmasq | OL 8 | 2.79-37.el8_10 | 2024 DNSSEC trust anchor refresh |
| qt5-qtbase | OL 8 | 5.15.3-9.el8_10 | CVE-2026-9499 OOB read fix |
| thunderbird | OL 8 | 140.14.0-1.0.1.el8_10 | 25 CVEs patched, OpenELA debranding, Oracle prefs added |
| polkit | OL 8 | 0.115-15.0.1.el8_10.3 | Timeout increase to prevent defunct processes, memory leak fix |
| perl-DBI | OL 8 | 1.641-2.el8_10 | Stack/heap overflows and unsafe eval fixes (CVE-2026-9698, 10879, 14380, 14739) |
| ksh | OL 8 | 20120801-272.0.1.el8_10 | Taskset workaround, /dev/fd redirection fix |
| dnsmasq | OL 9 | 2.85-18.el9_8.2 | 2024 DNSSEC trust anchor refresh |
| qt5-qtbase | OL 9 | 5.15.9-11.el9_8.1 | CVE-2026-9499 OOB read fix |
| sysstat | OL 10 | 12.7.6-4.0.1.el10 | Fixes sar reporting all-zero CPU rows |
| qt6-qt5compat | OL 10 | 6.10.1-1.el10_2.1 | CVE-2026-9499 OOB read fix |
Red Hat Enterprise Linux
Red Hat shipped another round of security patches this cycle, and the pattern is unmistakable: keep the foundational stack and container runtimes locked down. The updates span RHEL 8 through 10, hitting everything from a text editor you probably still use, to OpenShift 4.16.70 and OpenStack 17.1, which handle the heavy lifting. Most of these land with an “Important” severity rating, which is Red Hat’s standard way of saying “apply this, but save the emergency hotline call for something else.” Two items, apr-util on RHEL 10 and coreutils on RHEL 9, slip through with a “Moderate” rating. If you run SAP on RHEL 9.4 or stick to the extended support branches like RHEL 10.0 EUS, you’ll find fixes scoped specifically for those environments. The CVSS breakdowns live in the linked CVE references, so you can prioritize based on actual exposure rather than the advisory title.
| Component | Target System / Branch | Severity | Advisory ID | Scope |
|---|---|---|---|---|
| vim | RHEL 10 | Important | RHSA-2026:66336 | Security update |
| kernel | RHEL 8 | Important | RHSA-2026:66325 | Security, bug fix, enhancement |
| kernel-rt | RHEL 8 | Important | RHSA-2026:66324 | Security, bug fix, enhancement |
| osbuild-composer | RHEL 10.0 EUS | Important | RHSA-2026:66327 | Security, bug fix, enhancement |
| OpenShift Container Platform 4.16.70 | OCP (packages/images) | Important | RHSA-2026:62548 | Package and image updates |
| OpenShift Container Platform 4.16.70 | OCP (bug fix) | Important | RHSA-2026:62549 | Bug fix and security |
| httpd | RHEL 9.4 (SAP) | Important | RHSA-2026:66323 | Security update |
| freerdp | RHEL 9 | Important | RHSA-2026:66347 | Security update |
| vim | RHEL 9 | Important | RHSA-2026:66366 | Security update |
| apr-util | RHEL 10 | Moderate | RHSA-2026:66392 | Security update |
| coreutils | RHEL 9 | Moderate | RHSA-2026:66403 | Security update |
| gstreamer1-plugins-bad-free | RHEL 9.4 (SAP) | Important | RHSA-2026:66407 | Security update |
| rsyslog | RHEL 10.0 EUS | Important | RHSA-2026:66405 | Security update |
| gstreamer1-plugins-bad-free | RHEL 8.6 AMCU / EUS Long-Life | Important | RHSA-2026:66406 | Security update |
| Red Hat OpenStack Platform 17.1 (Wallaby) | RHEL 9.2 | Important | RHSA-2026:66401 | Security and bug fix |
| git-lfs | RHEL 9 | Important | RHSA-2026:66364 | Security update |
| kernel | RHEL 10 | Important | RHSA-2026:66355 | Security update |
| RHEL AI 3.6 RPM runtime (ffmpeg) | RHEL AI | Important | RHSA-2026:66381 | CVE fix |
| vim | RHEL 8 | Important | RHSA-2026:66348 | Security update |
| freerdp | RHEL 10 | Important | RHSA-2026:66349 | Security update |
| Red Hat AMQ Broker 7.13.6 | AMQ Broker | Important | RHSA-2026:66545 | Release and security |
| Red Hat AMQ Broker 7.14.1 | AMQ Broker | Important | RHSA-2026:66488 | Release and security |
Rocky Linux
Rocky Linux is pushing out four new errata packages across its supported streams. Three land on Rocky Linux 8, addressing security holes in the build automation tool osbuild-composer, the foundational GUI framework qt5-qtbase, and the compression utility gzip. The fourth targets Rocky Linux 10, shipping a tar update that patches vulnerabilities alongside routine bug fixes and enhancements. Two packages carry an Important severity rating, while gzip and tar sit at Moderate. Individual CVSS scores are linked to each CVE entry, so pull the patches through your standard update channel before those vulnerabilities turn into actual problems.
| Errata ID | Package | Severity | Affected OS | Scope |
|---|---|---|---|---|
| RLSA-2026:66016 | osbuild-composer | Important | Rocky Linux 8 | Security |
| RLSA-2026:65897 | qt5-qtbase | Important | Rocky Linux 8 | Security |
| RLSA-2026:65998 | gzip | Moderate | Rocky Linux 8 | Security |
| RLSA-2026:61586 | tar | Moderate | Rocky Linux 10 | Security, bug fix, and enhancement |
SUSE Linux
SUSE pushed a fresh batch of security patches this week, and the critical update for libzypp and zypper is the one you should prioritize. That announcement quietly bundles nine fixes into package versions 17.38.15 and 1.14.101, tightening up GPG key validation and repository caching along the way. The tomcat11 refresh is another heavyweight, addressing eleven vulnerabilities that range from authentication bypasses to WebSocket session leaks. You will want to apply that one before leaving it exposed on a production box. Helm picked up eight CVEs across gRPC, ORAS, and template parsing, while the rolling Tumbleweed repository dropped thirty-eight Chromium vulnerabilities in a single chromedriver bump. The opensc and waylyrics updates handle their respective memory corruption and redirect flaws, and corosync, ggml, and libmariadb round out the moderate tier. If you are running anything from SLE 15 SP6 through SP7 or Leap 15.6/16.0, a quick zypper patch will keep you aligned.
| Announcement ID | Component | Severity | Key Issues Addressed | Updated Version(s) | Primary Platforms |
|---|---|---|---|---|---|
| SUSE-SU-2026:4111-1 | python-Authlib | Moderate | Open redirect via crafted authorization requests (CVE-2026-41479) | 1.3.1 | openSUSE Leap 15.6, SLE 15 SP7 |
| SUSE-SU-2026:4112-1 | libzypp, zypper | Critical | Legacy cache invalidation, credential handling hardening, GPG key validation, plus 6 non-security fixes | libzypp 17.38.15, zypper 1.14.101 | openSUSE Leap 15.6, SLE 15 SP6 |
| SUSE-SU-2026:4114-1 | tomcat11 | Important | 11 vulnerabilities including auth bypass, TOCTOU race conditions, WebSocket session leaks, and allocation DoS vectors | 11.0.25 | openSUSE Leap 15.6, SLE 15 SP6/SP7 |
| openSUSE-SU-2026:21815-1 | waylyrics | Important | Open redirect flaw (CVE-2026-25541) alongside plugin and UI improvements | 0.4.0 | openSUSE Leap 16.0 |
| openSUSE-SU-2026:21809-1 | helm | Important | 8 CVEs spanning gRPC RBAC bypass, credential forwarding, and template parsing panics | 3.21.1/3.21.3 | openSUSE Leap 16.0 |
| openSUSE-SU-2026:21808-1 | libzypp, zypper | Critical | Same repository cache and GPG validation hardening plus 6 maintenance patches | libzypp 17.38.15, zypper 1.14.101 | openSUSE Leap 16.0 |
| openSUSE-SU-2026:11715-1 | corosync | Moderate | 2 CVEs affecting cluster messaging daemon | 3.1.10-5.1 | openSUSE Tumbleweed |
| openSUSE-SU-2026:11714-1 | chromedriver | Moderate | 38 Chromium/CDF vulnerabilities | 152.0.7977.82-1.1 | openSUSE Tumbleweed |
| openSUSE-SU-2026:11720-1 | ggml-devel | Moderate | 1 CVE in the GGML/LLAMA backend libraries | 0.4.0-1.1 | openSUSE Tumbleweed |
| openSUSE-SU-2026:11721-1 | libmariadb-devel | Moderate | 1 CVE in the MariaDB client library connector | 3.4.9-2.1 | openSUSE Tumbleweed |
| SUSE-SU-2026:4122-1 | opensc | Moderate | Stack buffer overflow in PIV history processing (CVE-2026-40510) | 0.22.0 | Leap 15.4, SLE Micro 5.3-5.5 |
| SUSE-SU-2026:4123-1 | opensc | Moderate | Same PIV memory corruption flaw as above (CVE-2026-40510) | 0.22.0 | Leap 15.6, SL |
Ubuntu Linux
Ubuntu pushed another batch of security patches. The headline here is a massive FFmpeg follow-up closing roughly fifteen separate parsing flaws, plus a Python update that patches a tarfile sandbox bypass and a few cookie injection bugs. PHP gets PostgreSQL backslash escaping fixes and a PHP 8.5 out-of-bounds write that only shows up on 26.04. If you are on Ubuntu 24.04 or 22.04, the .NET, PHP, and glibc updates land in the standard repositories. The Flatpak sandbox escape, KissFFT 32-bit crashes, and the Apache regression fix all live behind Ubuntu Pro. The NVIDIA kernel bump is particularly heavy: twenty-seven CVEs across networking, filesystems, and drivers, but you will need to reboot, and any unsigned third-party modules you compiled yourself will have to be rebuilt after the ABI change.
| Software | Notice | Affected Releases | Key Fixes | Update Version | Notes |
|---|---|---|---|---|---|
| .NET | USN-8740-1 | 26.04, 24.04, 22.04 | WebSocket validation bypass, privilege escalation via AspireServerService | dotnet10 10.0.112, dotnet8 8.0.131 | CVE-2026-58649, CVE-2026-69806 |
| FFmpeg | USN-8716-2 | 26.04 | ~15 parsing flaws across HEVC, NVDEC, S/PDIF, DASH, and others | ffmpeg 7:8.0.1-3ubuntu2+esm4 | Follow-up. Multiple +esm libs involved. |
| Netty | USN-8742-1 | 24.04 | NS record validation flaw enabling DNS cache poisoning | libnetty-java 1:4.1.48-9ubuntu0.2+esm2 | CVE-2026-47691 |
| Flatpak | USN-8741-1 | 24.04, 22.04, 20.04, 18.04 | Sandbox escape via symlinks, host file deletion via ld.so cache cleanup | flatpak 1.14.6 / 1.12.7 / 1.6.5 / 1.0.9 | CVE-2026-34078, CVE-2026-34079 |
| PHP | USN-8743-1 | 26.04, 24.04, 22.04 | PostgreSQL backslash SQLi, bccomp() OOB write (26.04 only), phar symlink DoS | php8.5 8.5.4, php8.3 8.3.6, php8.1 8.1.2 | CVE-2026-17543, CVE-2026-17544, CVE-2026-7260 |
| glibc | USN-8737-2 | 24.04 | strfmon overflow, tdelete OOB access, wordexp hangs/overflows | libc6 2.39-0ubuntu8.9 | Follow-up. Six CVEs total. |
| KissFFT | USN-8745-1 | 26.04, 24.04, 22.04 | Crash on large/quad Fourier transforms (32-bit) | kissfft-tools 131.1.0-...+esm1 | CVE-2025-34297, CVE-2026-41445 |
| Beets | USN-8747-1 | 26.04 down to 16.04 | XSS via unescaped media metadata in web UI | beets 2.5.1 (26.04) / 1.6.0 (24.04) / older | CVE-2026-42052 |
| libEBML | USN-8746-1 | 22.04 down to 16.04 | Buffer overflow from malformed read/write operations | libebml5 1.4.2 / libebml4v5 1.3.10+ | CVE-2023-52339 |
| Linux Kernel (NVIDIA) | USN-8748-1 | 24.04 | 27 CVEs across crypto drivers, Tegra, network stacks, GFS2/OCFS2/SMB, SCTP/TIPC | linux-image-6.17.0-1032-nvidia 6.17.0-1032.32 | Requires reboot. ABI change breaks unsigned third-party modules. |
| Python | USN-8744-1 | 26.04 down to 14.04 | Cookie injection, pyexpat recursion, tarfile hardlink filter bypass, HTML parser DoS | python3.14 3.14.4, python3.12 3.12.3, older | CVE-2026-3644, CVE-2026-4224, CVE-2026-4360, CVE-2026-6019, CVE-2026-15308 |
| Apache HTTP Server | USN-8571-2 | 20.04 | Regression fix (missing symbol broke HTTP/2 proxying). Original patch covered 14 CVEs across mod_ssl, mod_proxy, and others. | apache2 2.4.41-4ubuntu3.23+esm7 | Pro only. CVE-2026-33007 to CVE-2026-48913. |
How to apply these Linux security updates
Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.
Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.
Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.
Debian/Ubuntu (apt)
The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.
sudo apt update sudo apt upgrade -y
Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)
On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.
sudo dnf check-update sudo dnf upgrade -y
or on older releases
sudo yum check-update sudo yum update
SUSE (zypper)
SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.
sudo zypper refresh sudo zypper update -y
