Today's distributed Linux patching cycle hits hard across the board, with Debian's trixie kernel absorbing twelve CVEs for privilege escalation and info leaks while Gentoo finally addresses twenty-one tracked flaws in Tor, including a remote code execution vulnerability. Qubes OS published a particularly nasty bulletin detailing a dom0 command injection flaw triggered by copy errors, alongside Intel microcode updates that block cross-qube memory snooping but leave Meteor Lake processors unsupported due to stability concerns. Red Hat rolled out a massive wave of advisories spanning RHEL versions 7 through 10, with PAM getting twelve Moderate ratings and OpenShift receiving Important patches for three minor release branches, while SUSE tackled eight vulnerabilities in Vim and seventeen CVEs in the coturn TURN server. If you run any of these distributions in production, you should prioritize applying the patches, verifying dependency chains, and scheduling reboot windows before your next maintenance cycle.

Linux Security Roundup: Debian, RHEL, and Qubes OS Push Critical Patching Windows

A dozen CVEs just hit the Linux kernel, dom0 receives a direct shell injection fix, and Tor finally addresses remote code execution across the board. This week's distributed Linux security patching cycle wraps up just as summer maintenance windows traditionally open, and if you run Debian, RHEL, Gentoo, Qubes, or SUSE in production, your schedule just got noticeably tighter.

Debian's trixie branch absorbed twelve kernel CVEs this week. The advisory flags privilege escalation and information leaks tied to untrusted input hitting kernel subsystems. Roundcube needed its own cleanup pass. Ten vulnerabilities cleared, including a remote code execution flaw inside the markasjunk plugin, plus stored XSS and SSRF bypasses. python-httplib2 gets three patches. The unbounded gzip decompression fix is the one you should probably apply first. A moderately sized attachment can otherwise turn your CPU into a radiator. libnet-dns-perl and starlette round out the queue with denial of service and authorization bypass fixes.

Gentoo's advisories are shorter but sharper. Tor just got 21 tracked flaws addressed. The highest severity option lets an attacker execute code remotely. Freenet's problem is more surgical but arguably worse for a privacy tool. An XSS flaw can leak your identity to anyone with the right exploit chain. Neither advisory offers a workaround. Upgrade or leave it exposed.

Qubes OS Gets a Dom0 Command Injection Fix

Qubes OS published two bulletins, and QSB-118 is the kind of finding that makes virtualization enthusiasts do a double take. A compromised qube can run arbitrary commands in dom0 simply by tricking you into copying a file to it. The copy protocol strips non-ASCII characters and quotes, but it lets shell metacharacters slip straight through the system() call in dom0's error handler. Discovered by Tim C., the fix lands in qubes-core-dom0-linux 4.3.22. It applies to every supported Qubes release.

It is a familiar pattern. You copy a file. An error pops up. The system trusts the error message. Anyone who has managed to compromise a qube now has a direct line to dom0 if you initiate a copy. Dismiss it as a quirk of virtualization, or schedule the patch today. You will need to run Qubes Update and restart dom0 when prompted.

The microcode bulletin, QSB-117, tackles Intel CPU vulnerabilities tied to five separate advisories. The update blocks cross-qube memory snooping on supported chips like 10th and 11th gen Core processors and select Xeon variants. Intel pulled the Meteor Lake patch due to stability concerns, so Core Ultra Series 2 owners are currently in the dark. Anti Evil Maid users should expect to reseal their passphrases to the new PCR values after rebooting. At this point, that manual step is just the tax you pay for hardware-level isolation.

RHEL and SUSE Follow the Usual Rhythm

Red Hat pushed a massive wave of advisories this week, and PAM is showing up everywhere. Twelve Moderate ratings rolled out for RHEL versions 7 through 10, including some of the longer support branches. The Important tier covers OpenShift Container Platform minor releases for 4.14, 4.15, and 4.16, alongside packages like postgresql:12, freerdp, sg3_utils, xmlrpc-c, mingw-sqlite, dracut, and libxml2. Running dnf update is the only real decision to make, though checking the CVSS scores in the advisory references before applying to production boxes is still good practice.

SUSE rounded out the cycle with patches across SLE-15-SP7 Backports, Tumbleweed, and Leap 16.0. Vim took the biggest hit with eight vulnerabilities. Heap overflows in spell file loading, command injection through netrw, and a use-after-free in JSON decoding all cleared the queue. git-lfs patched a checkout routine that could spill files outside your working tree when symlinks point in the wrong direction. The GitHub CLI and V2Ray both absorbed fixes for a shared gRPC transport bypass. Tor finally addressed a race condition in onion service handling alongside a use-after-free in circuit management. The moderate batch covers coturn with seventeen CVEs, python-PyPDF2 with six memory traps, and routine hardening for libopenssl-3, java-25-openjdk, grafana, and trivy. You can run zypper patch or fire up YaST to install the updates before the weekend.

The Updates in Detail

Debian GNU/Linux

Debian security teams pushed a fresh round of patches this week, and the update queue covers a handful of packages you are likely running somewhere in your infrastructure. The Linux kernel took the biggest hit with twelve CVEs addressed in trixie, plugging privilege escalation and information leak paths that usually open up when untrusted input reaches kernel subsystems. Roundcube needed another round of damage control too, with ten vulnerabilities fixed across a dozen CVEs. The webmail client has historically treated input sanitization as a guideline, so this release tackles everything from stored XSS and SSRF bypasses to a literal remote code execution flaw in the markasjunk plugin. python-httplib2 gets three patches here, with the unbounded gzip decompression fix probably being the one you want to prioritize before a moderately large attachment turns your CPU into a space heater. libnet-dns-perl and starlette round out the list with denial of service and authorization bypass fixes. If your maintenance window slipped past last week, clearing these updates should be on the schedule.

Gentoo Linux

Two high-severity security patches hit the Gentoo repositories, and if you are running Tor or Freenet on an older build, it is time to patch. The Tor advisory handles 21 separate tracked flaws, with the worst case allowing an attacker to execute code remotely. Freenet's problem is a bit more surgical but arguably worse for a privacy tool: a cross-site scripting flaw that leaks your identity to someone who knows how to exploit it. Neither advisory provides a stopgap workaround, so the upgrade is the only real option.

Qubes OS

Qubes published two security bulletins. QSB-117 tackles a batch of Intel CPU microcode updates tied to five separate security advisories. Intel pulled the patch for Meteor Lake processors due to stability issues, leaving you in the dark about how those systems actually fare. For supported chips like 10th/11th gen Core and several Xeon variants, the microcode update aims to block cross-qube attacks where a compromised VM tries to snoop on others. You will need to restart dom0 after applying it, and if you use Anti Evil Maid, expect to reseal your passphrase to new PCR values.

QSB-118 is the uglier find. A qube can execute arbitrary commands in dom0 simply by tricking you into copying a file to it and triggering an error. The copy protocol strips out non-ASCII characters and quotes, but it lets shell metacharacters slide right past the system() call in dom0's error handler. Anyone who has managed to compromise a qube now has a direct line to dom0 if you initiate a copy. The fix lands in qubes-core-dom0-linux 4.3.22, and it applies to every Qubes release.

Both updates travel through the standard Qubes Update path. Run the update and restart dom0 when prompted.

Red Hat Enterprise Linux

Red Hat just pushed another round of security advisories, and pam is showing up everywhere. You will find twelve Moderate ratings for the PAM package rolling out across RHEL versions 7 through 10, including some niche branches like Extended Lifecycle Support and SAP/Telecom services. The Important ratings cover a broader mix. Three OpenShift Container Platform minor releases (4.14, 4.15, and 4.16) pick up bug fixes alongside security patches, while packages like postgresql:12, freerdp, sg3_utils, xmlrpc-c, mingw-sqlite, dracut, and libxml2 round out the list. If you run any of these on your servers, running dnf update is likely the only decision you need to make today. The CVSS scores live in the advisory references, so peek at those before blindly slapping patches on production boxes.

SUSE Linux

SUSE rolled out another batch of security patches this week, and the severity mix follows the usual rhythm. The important-rated updates land on vim, git-lfs, gh, v2ray-core, and tor. Vim takes the biggest hit, closing eight vulnerabilities that span heap overflows in spell file loading, command injection through netrw, and a use-after-free in JSON decoding. Git-LFS patches a checkout routine that could spill files outside your working tree when symlinks point in the wrong direction. The GitHub CLI and V2Ray both absorb fixes for a shared gRPC transport bypass and a few terminal escape sequence injections. Tor rounds out the important tier by locking down a race condition in onion service handling and a use-after-free in its circuit management.

The moderate batch covers the usual suspects: coturn with seventeen CVEs around TURN protocol handling, python-PyPDF2 scrubbed for six crafted-PDF memory traps, and routine hardening passes for libopenssl-3, java-25-openjdk, grafana, and trivy. coredns, broot, cadvisor, distribution-registry, and pyenv round out the list with smaller, targeted fixes. All three channels, SLE-15-SP7 Backports, Tumbleweed, and Leap 16.0, get their respective packages bumped. You can run zypper patch or fire up YaST online_update to get things installed before the weekend.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world