Linux distributions spent the past three days pushing a massive wave of security patches, with FFmpeg, Chromium, and Erlang leading the critical fix list. Fedora 44 ships Chromium 151 to scrub twenty-three vulnerabilities, while Debian and SUSE target severe TLS hardening and kernel live patches that will break older cluster configurations. Ubuntu locks its FFmpeg updates behind a Pro subscription, and AlmaLinux issues an important advisory for an MRTG local privilege escalation that demands immediate patching. You should run your package manager now and prioritize the media parsing and privilege escalation fixes before tackling the broader network stack updates.

Linux Security Roundup: Chromium, FFmpeg, and Kernel Live Patches Hit Major Distros

Critical fixes for privilege escalation, browser internals, and media parsing flaws land across AlmaLinux, Debian, Fedora, RHEL, SUSE, and Ubuntu this week.

Linux distributions spent the last seventy-two hours pushing a massive wall of security patches, and if your systems haven't run a package manager update since last Tuesday, you are sitting on quite a few unpatched attack surfaces. The standout this round targets media parsing, browser internals, and local privilege escalation, with FFmpeg, Chromium, and Incus leading the hit list.

The Red Hat Ecosystem

Fedora 43 and 44 shipped kernel 7.1.10, which quietly fixes a Framework laptop audio jack quirk alongside a long list of upstream CVEs. The real headline there is Chromium 151 on Fedora 44, which scrubs twenty-three CVEs ranging from privilege elevation in imports to use-after-free bugs in the V8 engine. Nextcloud 34.0.3 lands for home lab operators, sealing XSS flaws and prototype pollution bugs that could poison your file server.

Over in RHEL and Rocky Linux, the patch cycle follows a familiar pattern. Firefox 140.14.0 catches nearly thirty vulnerabilities on the ESR line, while Python 3.12 and 3.14 both get refreshed. NetworkManager updates across the board disable default MPTCP handling, which Oracle explicitly noted was a connectivity hardening step rather than a feature removal. If you run Rocky Linux 8, you will notice qemu-kvm finally bundles bug fixes and enhancements alongside the security work. It is a rare courtesy from upstream, and you should appreciate it.

Debian, SUSE, and AlmaLinux

Debian pushed four advisories this week, and the Erlang update alone covers twenty-seven CVEs. The runtime is tightening TLS and network daemon validation rules. That means a few older cluster configurations will fail to start after the upgrade, so audit your certificate setups before you restart nodes. WebKitGTK rounds out the batch with eight browser vulnerabilities, including iframe sandbox escapes and UI spoofing vectors.

SUSE's entry is heavier on the infrastructure side. util-linux gets five CVEs patched, mostly around a heap use-after-free in libblkid and a TOCTOU race in the mount program. The 389-ds directory server sees an integer overflow that bypasses size limits to trigger a heap buffer overflow. GIMP seals an arbitrary code execution path through an unsigned underflow in the PSD plugin. SUSE also released a relentless stream of kernel live patches for SLE 15 SP4 through SP7. Apply those first if you cannot clear the full queue in one maintenance window.

AlmaLinux 9 and 10 both pick up OpenJDK 25 with moderate severity ratings. The MRTG patch on AlmaLinux 10 is the one that actually demands immediate attention. It closes a local privilege escalation gap where a low-privilege shell user can manipulate PID file paths to trick the daemon into running chown against a symlinked target. If your network monitoring stack relies on MRTG, apply this now.

Ubuntu and Gentoo

Ubuntu split its August notices into three tracks. curl gets fixed for a bug where it hands over the wrong client certificate when you switch settings mid-session. The Java AsyncHttpClient update seals a cross-domain cookie planting vector. FFmpeg is where it gets interesting. Malformed media files can trigger denial of service, arbitrary code execution, or information leaks, but every FFmpeg update here lives behind Ubuntu Pro or ESM. Unregistered users on supported releases cannot pull the fix through a standard apt upgrade.

Gentoo published a high severity advisory for Incus before 7.0.1-r1. The specific impact details stay vague, but the headline is privilege escalation running hot next to your containers and VMs. There are no workarounds listed, which means syncing and upgrading is the only option.

The Bottom Line

It is a rather dense week for package maintainers, though the distribution teams are doing the heavy lifting so you do not have to hunt individual build numbers. The biggest operational headaches will come from the Erlang TLS hardening in Debian, the MPTCP default disable in Oracle and RHEL, and the Ubuntu Pro paywall around FFmpeg. Keep your kernel live patches prioritized on SUSE. Run your package manager. If you cannot do everything at once, hit the privilege escalation and media parsing fixes first.

The Updates in Detail

AlmaLinux

AlmaLinux released three security errata on August 24, 2026, and the one that actually demands attention right now is the MRTG patch for AlmaLinux 10. It closes a local privilege escalation gap in the traffic monitoring daemon where an attacker with basic shell access can manipulate PID file paths to trick the service into running chown against a symlinked target. If your network monitoring stack relies on MRTG, you will want to apply this before someone with a low-privilege account gets ambitious.

The OpenJDK 25 patch lands on both AlmaLinux 9 and 10 with a moderate severity rating. It addresses four internal JDK concerns spanning resource resolution, HTTP connection handling, font loading, and TLS server hardening. The CVSS scores sit in the moderate range, and since the upstream disclosure hasn't published public exploit code, you are mostly plugging abstract attack surface rather than squashing an active remote code execution chain. Still, you should treat it as a standard patch cycle item, especially if your servers run long-lived Java services that parse user-controlled input or render untrusted fonts.

Debian GNU/Linux

Debian pushed out four security advisories, and if your system runs any of the affected packages, it is time to run an upgrade. The batch spans storage management, web rendering, distributed runtimes, and email clients. The OpenZFS advisory closes a permission check that allowed unprivileged containers to act as the host storage administrator. WebKitGTK addresses eight vulnerabilities that let a malicious site crash your browser, bypass iframe sandboxes, or spoof the interface. Erlang takes the biggest hit with twenty-seven CVEs patched, mostly around TLS and network daemons. The runtime is tightening validation rules that will intentionally break a few older configurations, so you should audit your cluster and certificate setups before applying the update. Thunderbird lands a standard ESR hardening round for bullseye and bookworm, sealing up arbitrary code execution and data leak paths. All fixes are already available in the repositories for trixie and the long-term support releases.

Fedora Linux

Fedora shipped a fresh batch of security updates for Fedora 43 and 44, and if you're running unpatched systems, you're sitting on quite a list. Fedora 43 picks up the August CPU patches for OpenJDK 26 and 25, alongside a move to OpenJDK 21's monthly cadence release candidate. The stable kernel climbs to 7.1.10, bringing along a quirk fix for Framework device audio jacks. You'll also want to apply the Nextcloud 34.0.3 update if you run your own file server, as it addresses a cluster of XSS flaws, cookie disclosure issues, and prototype pollution bugs. The perl-URI module gets a patch for IDNA host encoding, and libxls fixes two information disclosure vulnerabilities in old Excel file handling.

Fedora 44 mirrors the kernel jump to 7.1.10 and picks up the same OpenJDK updates, but the headline there is Chromium 151. The browser update tackles 23 CVEs, ranging from privilege elevation in imports to race conditions in V8 and use-after-free bugs in the DOM and GPU. It's a lot of surface area to scrub, but the patches are in. FreeIPA lands at 4.13.3 to resolve seven security issues, including trust-fetch-domains bypasses and authentication DoS flaws. The Samba bump to 4.24.6 alongside it exists purely to ensure the FreeIPA package version on F44 stays higher than F43; otherwise, upgrades break. You'll find JFrog CLI updated to 2.120.0 with fixes for a Sigstore policy bypass and an OpenTelemetry DoS, while Calibre 9.13.0 closes an RCE via Python template restrictions and unauthorized annotation modifications.

Gentoo Linux

If you are running Incus for containers or VMs on Gentoo, patch today. The distribution just published a High severity advisory covering a dozen-plus flaws in versions older than 7.0.1-r1. The headline risk is privilege escalation, which is never something you want sitting next to your workloads. The advisory keeps the specific impact details vague, so you will need to cross-reference the CVE list if you actually want to know what each flaw does. There are no workarounds listed, so waiting it out is not an option. Sync your system and upgrade to app-containers/incus-7.0.1-r1 or later to close the door.

Oracle Linux

Oracle Linux just pushed another batch of errata, and if you are running any supported version from 7 through 10, your package manager just gained a lot of work. Security patches dominate the list. Firefox 140.14.0 leads the pack with nearly thirty vulnerabilities patched in a single release. Python 3.14 jumps to 3.14.7, and PHP gets 8.3.33 and 8.2.33 on older branches. QEMU closes out a heap buffer overflow in virtio-blk that would have made debugging a chore. The OL8 kernel gets two separate advisories, covering everything from memory management to network stack quirks. NetworkManager appears across multiple versions, with Oracle disabling default MPTCP handling and tightening dispatcher directory permissions. If you have not patched in the last couple of weeks, running your update now keeps you aligned with upstream fixes.

Red Hat Enterprise Linux

Red Hat just shipped another batch of security errata, and if you manage any Red Hat Enterprise Linux host from 7 through 10, your patch management tools probably lit up already. The severity split here is straightforward: the vast majority of these advisories land on "Important," which typically means an attacker could leverage the flaw for remote code execution or privilege escalation if left unpatched. The "Moderate" ratings are scattered across NetworkManager, assertj-core, qemu-kvm, cups-filters, libarchive, and libgcrypt.

You will find updates for your firewall fencing layer (fence-agents and resource-agents), remote desktop tools (freerdp), and your browser (firefox) across nearly every active RHEL stream. The Python ecosystem gets double coverage, with both 3.12 and 3.14 patched, while .NET 8.0 and 9.0 cover multiple update paths. If you run the Extended Lifecycle Support, Advanced Mission Critical Update Support, SAP, or Telecom streams, you are covered on legacy and niche tracks alike. Ansible Automation Platform 2.5 through 2.7 also received its security treatment, and the kpatch hotfixes for various kernel versions are bundled together so you are not hunting individual build numbers. Long story short, run your yum update or dnf upgrade, especially if you are sitting on RHEL 7 or specialized SAP/telecom branches.

Rocky Linux

Rocky Linux issued a fresh batch of security advisories across versions 8, 9, and 10, and you will want to run your package manager before this hits production. The lineup leans heavily on patching vulnerabilities, with python-urwid, NetworkManager, and Firefox catching "Important" rated updates. The qemu-kvm entry for version 10 is the only one that actually bundles bug fixes and enhancements alongside the security work, which is usually a rare courtesy from upstream maintainers. If your compliance workflow requires specific CVSS scores, the errata pages link directly to the CVE breakdowns so you can justify the maintenance window.

SUSE Linux

SUSE rolled out a serious stack of security patches this week, and if you run their Enterprise Linux releases or Tumbleweed, you have a lot of ground to cover. The headline fixes land on Chromium (7 CVEs, including a privilege escalation in import and a use-after-free in Chromoting), util-linux (5 CVEs, with a heap UAF in libblkid and a TOCTOU race in the mount program), and 389-ds, where an integer overflow bypasses size limits to trigger a heap buffer overflow. GIMP gets two patches, one of which seals an arbitrary code execution vector via unsigned underflow in the PSD plugin. The real bulk of this release is a relentless drip-feed of kernel live patches across SLE 15 SP4 through SP7. They share a familiar roster of fixes (SCTP cookie echo validation, IPv4 ICMP pointer checks, various double-frees, XFS mapping resampling), rolled out in numbered batches that you will need to apply in sequence. Tumbleweed users should grab the corresponding packages for Thunderbird (31 CVEs), PostgreSQL 17 (25 CVEs), and both Erlang builds (21-24 CVEs each). Run zypper patch or use YaST. If you cannot do everything at once, prioritize the kernel patches first. They are where the heavy lifting lives.

Ubuntu Linux

Ubuntu published three security patches this month, and if your stack touches the network or processes media, applying them is straightforward. The August 20 notice targets a flaw in Java's AsyncHttpClient where a lax cookie validation lets attackers plant cross-domain cookies that follow requests to unrelated sites. The August 24 notices handle the rest. The first one patches curl, which used to hand over the wrong client certificate when you switched settings mid-session. The second one tackles FFmpeg, where malformed media files could trigger crashes, run arbitrary code, or leak sensitive data. FFmpeg updates land behind Ubuntu Pro for every supported release, which keeps legacy boxes secure but locks unregistered users out of the fix. A standard system update handles the curl and AsyncHttpClient patches without extra steps.

The FFmpeg row entries cover the full libavcodec, libavformat, libavfilter, libavutil, libavdevice, libpostproc, libswresample, and libswscale families shipped with each release. Curl and AsyncHttpClient updates apply to the standard repositories, while every FFmpeg package lives in the Ubuntu Pro or ESM channel. A regular apt upgrade will pull the curl and AsyncHttpClient fixes automatically. FFmpeg requires an active Pro subscription or ESM access to actually install.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world