Debian's Freexian-managed kernel advisory for bullseye packs a staggering 597 CVEs into its 5.10.272-1 update, with trixie's stable kernel still carrying 273. AlmaLinux, Oracle Linux, and others shipped overlapping Critical FreeIPA fixes covering eight CVEs each, including an unauthenticated LDAP client that can grant itself administrator rights. A genuine guest-to-host VM escape, CVE-2026-99999 "PwnEscape," is already sitting in testing for AlmaLinux 8, 9, and 10 but hasn't hit production yet. Patch priorities include the FreeIPA directory fixes and the Freexian kernel, while Debian, Fedora, Rocky, RHEL, SUSE, Slackware, and Oracle all pushed their usual batch of routine updates you can apply through your familiar package manager.

Today's distro security roundup hides a kernel of 597 CVEs

A routine cycle of updates turns up a Freexian-managed kernel with nearly six hundred flaws, overlapping FreeIPA criticals across the enterprise distros, and a guest-to-host VM escape quietly waiting in a testing repo.

If you've been scanning today's distro bulletins for something to lose sleep over, here it is. Debian's Freexian-managed kernel advisory for bullseye bundles 597 CVEs into a single 5.10.272-1 update. The trixie stable kernel isn't far behind, packing 273 into 6.12.113-1.

That's the kind of volume that makes a competent sysadmin close the email without reading past the subject line.

The numbers behind the noise

Keep in mind that most of those 597 flaws belong to a kernel Debian no longer maintains directly. bullseye has aged out of stable support, so Freexian's Extended LTS program inherited it. The 597 is just the expected cost of that handoff, and it'll keep climbing until the line finally retires.

The trixie update is different in one respect. Only two of its 273 trace back to 2025. The rest are 2026 bugs, which means you're accepting a very recent and very large diff on a stable system. Not cheap to digest.

Debian's Apache bump landed at 2.4.69-1~deb13u1, closing 19 CVEs including a real HTTP request smuggling hole. Smuggling is the one worth watching most closely, since it tends to open doors the other symptoms merely rattle. Then jq on bookworm (DLA-4840-1) got a repeat-string overflow fix. A prior fix capped one growing string but let an asterisk repeat keep stacking. The new build now fails loudly with a "Repeat string result too long" message instead of quietly overflowing. Two more memory bugs got squashed without CVE numbers, including one where ("a"*200)*30 copied from memory that had already been freed. That last one alone is enough to make you stare at a compiler for a minute.

FreeIPA and the escape in the test repo

Here's the thread tying the day together. AlmaLinux, Oracle Linux, and a handful of others shipped overlapping FreeIPA fixes, and at least one is Critical.

AlmaLinux wrapped eight CVEs into a single errata for AlmaLinux 8 (ALSA-2026:83460). One is genuinely ugly: an unauthenticated LDAP client can hand itself administrator rights through the self-managed-token ACI. Trust-fetch-domains lets a privileged AD trust refresh slip past a read access control, opening the door to unauthorized LDAP writes. Then there's an idp-add path where eval() runs before the authorization check even happens.

Oracle graded its own idm:DL1 update Critical on Linux 8, covering the same eight FreeIPA CVEs. ELSA-2026-83460 pushes FreeIPA to 4.9.13-21.3.0.2. If you run a directory, this lands at the very top of your list, distro or not.

Then comes PwnEscape, CVE-2026-99999. The nickname and the number read like a novelty, but it's a real guest-to-host VM escape. A guest you control can leak the host's kernel memory, crash the host, or run code as root. Red Hat and the kernel CVE team both rate it Critical.

AlmaLinux 8, 9, and 10 are in scope. Patched kernels are already sitting in the testing repo, and the distro wants people to verify them before pushing to production. That's a mild chore, but shipping a kernel update blind is exactly how a vulnerability becomes a story you read about instead of one you fixed ahead of time.

The rest of the day

Fedora's batch hides a small dependency-chain lesson. Nant isn't the vulnerable one; it was just the only Fedora package still dragging an old log4net. log4net jumped to 3.5.0 to patch four CVEs, and you'll see those same CVEs reappear under the nant advisory. That's how modern package trees work, whether you find it elegant or exhausting. Meanwhile OpenSSL rebased to 3.5.9 in Fedora and closed 14 CVEs in a single package, while Chromium landed 37 fixes across both Fedora 43 and SUSE's SLE-15-SP7 build, moving to 155.0.8059.79. The Chromium advisory describes it as "a WebKit (Blink) powered web browser that Google doesn't want you to use." That's about as honest a description as you'll find anywhere.

On SUSE's side, libsoup2 took 15 fixes to 2.74.3, and a companion urllib3 patch closes a 9.1-scored HTTPS proxy override. If your scripts route traffic through a proxy, that one's worth a look.

Slackware took a different route entirely, patching four X11 libraries for both 15.0 and -current, which suggests someone was reading some network input a little too literally. libXi is the busiest with nine problems, several of them out-of-bounds reads and heap overflows buried in device-state parsing. The common thread across all four is untrusted input being treated as trustworthy. Nothing subtle there. Upgrade as root via upgradepkg.

RHEL, Rocky, and Oracle shipped their usual kernel and ghostscript roundups. RHEL's kernel updates landed as "Important" across its SAP-tuned, extended-support, and RHEL 10 tracks, so they aren't top-of-the-world ratings. But you wouldn't want to sleep through any of them. Rocky handed out 17 errata across all three supported releases, with kernel, ghostscript, and rpcbind each getting their own advisory.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux pushed two notable things out, and either one is worth a look before you get too comfortable.

The first is a critical security update for AlmaLinux Identity Management (that's what FreeIPA becomes when you put it in an enterprise box), aimed at AlmaLinux 8. It lands as a single errata (ALSA-2026:83460) but packs eight separate CVEs, which is a fair number to squeeze into one package. Two of them are unauthenticated denials of service hiding in the /ipa/i18n_messages and /ipa/migration/migration.py endpoints, each triggered by an unbounded request body read. There's a cross-site scripting flaw that the distro quietly claims can run arbitrary code through a crafted URL, plus a privilege escalation that slips through when krbCanonicalName is manipulated because the datastore enforces uniqueness domain-wide instead of per account. The credentials-theft story is the shakiest: an unauthenticated LDAP client can basically hand itself administrator rights through the self-managed-token ACI, and trust-fetch-domains lets a privileged AD trust refresh slip past the read access control, opening the door to unauthorized LDAP writes. Round out the list with an idp-add path where eval() runs before the authorization check, giving both environment disclosure and denial of service, and a bug fix patching ipatests for kdcproxy on top.

Then comes PwnEscape, CVE-2026-99999. The number and the nickname suggest a novelty, but it's a genuine guest-to-host VM escape: a guest you control can leak the host's kernel memory, crash the host, or run code as root. Red Hat and the kernel CVE team both call it Critical, and AlmaLinux 8, 9, and 10 are all in scope. Patched kernels are already sitting in the testing repo, and the distro is asking people to verify them before it sends them to production. That step is a mild chore, but pushing a kernel update to production blind is exactly how vulnerabilities like this become stories you read about instead of fix ahead of time.

Debian GNU/Linux

Debian handed out a pile of security updates on October 16, and the CVE lists are the kind that makes a competent sysadmin close the email without reading it. Four separate advisories cover the Linux kernel in both its active and long-term-flavored forms, plus the Apache web server and the JSON command-line tool jq. The fixes themselves are routine. The sheer volume is not.

The main kernel update (DSA-6568-1) for the stable trixie release ships version 6.12.113-1 and bundles 273 CVEs, only two of which trace back to 2025 with the rest landing in 2026. Privilege escalation, denial of service, and information leaks are the headline risks. Patching is the obvious move, though the list is long enough to earn a pause before you accept the diff.

There is a second kernel advisory (ELA-1846-1), but it comes from Freexian's Extended LTS program rather than Debian's own stable branch, because bullseye has aged out of Debian's direct maintenance. It targets version 5.10.272-1 and carries a staggering 597 CVEs. Same trio of symptoms, just a bigger spreadsheet. That is the expected payoff once a distro line passes its main support window.

Apache got 19 CVEs in DSA-6569-1. The 2.4 branch now ships version 2.4.69-1~deb13u1 for trixie, closing a hole for HTTP request smuggling alongside denial-of-service, information disclosure, and an authentication bypass. Smuggling is the one worth watching most closely, since it tends to open doors the other symptoms merely rattle.

The jq advisory (DLA-4840-1 for Debian 12 bookworm, version 1.6-2.1+deb12u3) is the one with an actual story. A prior fix for CVE-2026-32316 capped one string from growing past its limit but let a string repeated with an asterisk keep stacking. The new build makes such a repeat fail loudly with a "Repeat string result too long" message instead of quietly overflowing. Two more memory bugs got squashed without CVE numbers, including one where ("a"*200)*30 copied from memory that had already been freed. A separate crash from deep delpaths is still being pushed upstream before it lands here, so that one remains only partially closed.

Fedora Linux

Fedora's security team shipped a long batch of advisories, and the list runs both Fedora 43 and Fedora 44. Most of it is routine maintenance, but a handful of entries make you actually want to open a terminal.

The biggest jump is OpenSSL, which rebased to 3.5.9 and closed 14 CVEs in a single package. Chromium took an even larger hit, landing 37 separate security fixes in 155.0.8059.79. The advisory describes the package as "a WebKit (Blink) powered web browser that Google doesn't want you to use," which is about as honest a description of Chromium as you'll find.

Then there's the dependency-chain awkwardness. Nant isn't the vulnerable one; Fedora simply rebuilt it because it was the only Fedora package still dragging the old log4net along, and log4net needed its own bump to 3.5.0 to patch four CVEs. You'll see those exact log4net CVEs reappear under the nant advisory, which is a small lesson in how modern package trees work.

Everything else is the usual security spread: WordPress got its normal 6.9.10 pass, Django got version-specific patches across both 5.2.18 and 6.1.2, the kernel moved to 7.2.11 for both distros, and a scattered bunch of tools (Tor, FreeIPA, Apache httpd, syncthing, several Go-based CLIs) all got tightened up. If you're on either release, dnf will fetch these with the usual --advisory command.

Oracle Linux

Oracle Linux shipped another round of security errata across Linux 8, 9, and 10, and the severity spread tells you roughly what to touch first.

The standout is the idm:DL1 update on Linux 8, which Oracle graded Critical for reasons that hold up. It covers eight CVEs across FreeIPA, including an unauthenticated LDAP client grabbing administrator credentials through the self-managed-token ACI, privilege escalation via krbCanonicalName manipulation, a trust-refresh hole that allows unauthorized LDAP writes, and a couple of XSS flaws where a crafted URL executes code. If you operate a FreeIPA directory, this sits at the top of the list.

The kernel errata is where the sheer volume lives. ELSA-2026-500395 pushes UEK 5.15.0 to both Linux 8 and 9, and the changelog reads like a firehose spanning networking, the block layer, BPF, KVM, and just about everything else. The 6.12.0 update (ELSA-2026-500394) went out to Linux 9 and 10 with a smaller but still substantial batch, including landlock and xfrm use-after-free fixes.

The rest follow the usual pattern. Ghostscript picks up the same pair of CVEs (a -dSAFER sandbox bypass plus a pdfwrite stack overflow) whether you're on Linux 8, 9, or 10, since Oracle just chases the upstream releases. libsoup gathers a cluster of WebSocket heap overflow bugs on Linux 9, while libsoup3 on Linux 10 stacks those plus an uninitialized-length base64 hole and some HTTP/2 crash fixes on top. rpcbind lands the same unauthenticated remote DoS fix on all three releases. Grafana, lrzsz, environment-modules, wireshark, hplip, and linux-firmware round things out.

A note on hplip: it ships the same eleven CVEs on Linux 9 and 10, and Oracle's own changelog has to "really fix" a missing /var/lib/hp directory that it apparently missed twice before. You probably won't need the third reminder.

Version numbers you'll actually want when checking what's installed: Linux 8 ghostscript goes to 9.27-19, Linux 9 to 9.54.0-19, Linux 10 to 10.02.1-16. libsoup climbs from 2.72.0-15 to 2.72.0-16 on Linux 9, and libsoup3 stacks a pile of fixes under 3.6.5-3 on Linux 10. The UEK kernels jump to 5.15.0-325.221.6.3 and 6.12.0-207.111.5.3 respectively.

Red Hat Enterprise Linux

Red Hat has pushed a batch of kernel security updates across several RHEL tracks, and they're all stamped "Important" severity. Not exactly a top-of-the-world rating, but you wouldn't want to sleep through these either. The advisories land on the SAP-tuned releases, the older extended-support line, and the new RHEL 10 track.

Most of these are pure security patches. One is broader, folding in bug fixes and enhancements alongside the security work. Red Hat notes you can find the detailed severity ratings and CVSS base scores on each CVE link in the references of the full advisory. The practical takeaway: apply the one for your version.

Rocky Linux

Rocky Linux handed out 17 errata advisories this cycle, reaching across Rocky Linux 8, 9, and 10. The kind of routine security housekeeping you'd rather apply proactively than dig out of the wreckage afterward. Most carry an "Important" rating, with a single wireshark update dropping to "Moderate."

The package list repeats enough to be worth flagging. Ghostscript, rpcbind, and kernel each got their own separate advisory on all three supported releases. The real-time kernel (kernel-rt) gets its own attention too, for whatever servers run on that variant. The rest are one-and-done: libsoup, hplip, grafana, and lrzsz.

Slackware Linux

Slackware's security team just pushed a batch of patches for four X11 libraries, which suggests someone was reading some network input a little too literally. All four land for both Slackware 15.0 and -current, and cover both x86_64 and the 32-bit variants.

libXi is the busiest of the lot, carrying nine separate problems, several of them out-of-bounds reads and heap buffer overflows buried in device-state and class parsing. That's the one you'd want to get onto first. libX11 arrives with four fixes, running the gamut from bounded XIM attribute lengths to a keysym range check. The other two are more focused: libXrender's flaw is a single out-of-bounds read in its format reply parser, while libXpm's is a denial of service coming from an unsigned underflow in the write path. The common thread across all four is untrusted input being treated as trustworthy, which is about as predictable as vulnerabilities get.

Upgrade proceeds the usual way, as root, via upgradepkg. Everything you'd need to script it - package URLs, MD5 sums, advisory links - is spelled out in the release.

SUSE Linux

SUSE shipped a broad round of security updates, and only two of the fourteen carry an "important" rating, which is where the real interest sits. Chromium takes the biggest single fix on openSUSE Backports SLE-15-SP7, closing out 37 vulnerabilities as the build moves to 155.0.8059.79. The damage spans use-after-free flaws across Browser, PDF, Network, Media, and DOM, plus buffer overflows in ANGLE, Animation, and PDFium. Passwords and the Installer show up on the list, so a few of these are more interesting than your average batch.

On SUSE Linux Enterprise, libsoup2 absorbs 15 fixes and lands at 2.74.3. A lot of them ride through WebSocket frame handling as heap buffer overflows, and one opens the door to HTTP request smuggling through a body-draining gap. A companion python-urllib3 patch for the same platform closes 3 issues, led by a 9.1-scored HTTPS proxy override that could let traffic slip past a proxy. If your scripts route through one, that one's worth a look.

The rest is Tumbleweed's usual run of "on GA media" moderate advisories. libthrift pulls the biggest Tumbleweed number at 33. Qemu jumps to 11.1.1-2.1 after a 9.3 privilege escalation, qsnapper clears 5, and a handful of Python utilities (urllib3, urllib3_1, zipp, waitress, validators, ruff, and social-auth-app-django) each swallow their own CVE. glib2 finishes the set on Leap 15.4 and SUSE Linux Enterprise Micro with a single SASL denial of service.

All together that's 121 vulnerabilities across 14 advisories, and the install path is the standard zypper or YaST route you already know.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all