Linux Security Roundup for Week 12, 2026

Security 10938 Published 2026-03-22 08:41 by Philipp Esselbach

News

Many Linux distributions released security notifications covering AlmaLinux, Debian, Fedora, and Red Hat Enterprise Linux which contain critical flaws in core system files. Administrators should install patches immediately for applications like Chromium and ImageMagick because these vulnerabilities could enable denial of service attacks or remote code execution risks. Critical fixes address issues within tools like Python and libpng to stop attackers from exploiting known flaws. Users on other distributions such as Oracle and Ubuntu also need to prioritize updates for kernel components and webmail software to ensure safety against active exploits in the wild.

Critical Linux Security Updates for Enterprise and Home Users

This week's Linux Security Roundup highlights several critical patches that demand immediate attention from system administrators and desktop users alike. Managing servers feels less like IT support these days and more like constant maintenance work. This week brought a heavy batch of patches across the ecosystem that requires immediate attention from system administrators. Reading through the latest advisories helps teams prioritize which Linux security updates actually matter versus routine bug fixes. Users who rely on stable infrastructure should not delay deployment because many flaws are already active in the wild.

Enterprise Distributions and Core Services

Red Hat based platforms released numerous advisories targeting the kernel and boot loaders across versions seven through ten. A use after free flaw was patched within grub2 to stop potential denial of service attacks during boot sequences. Container tools received important fixes because isolation failures in this area are often used by attackers to gain root access on compromised systems. Admins should install patches for tools including Python and VIM immediately to maintain system integrity against privilege escalation attempts.

Web Applications and Desktop Security

Debian and Fedora users should pay close attention to changes involving Chromium and ImageMagick this week. Exploits are already active in the wild so users must act quickly to prevent execution risks within web browsers that handle daily user input. Memory corruption flaws were found inside tools like Vim and GIMP which could lead to local privilege escalation on affected machines. Developers relying on Python libraries should verify their packages are updated before deploying new scripts to production servers.

Virtualization and Specialized Platforms

Qubes OS issued a bulletin concerning EPT structures within paging mechanisms that require verification via cryptographic signatures. This specific fix addresses vulnerabilities that could otherwise allow unprivileged users to access memory they should not touch inside the operating system. Oracle Linux focused on infrastructure components like SOS reporting and FreeRDP connections used for remote desktop work across enterprise data centers. It has been observed that applying these fixes alongside dependent packages requires careful testing to avoid breaking build tools or database clients.

The Security Updates in Detail

Here is an in-depth overview of the updates recently released for AlmaLinux, Debian GNU/Linux, Fedora Linux, Oracle Linux, Qubes OS, Red Hat Enterprise Linux, Rocky Linux, Slackware Linux, SUSE Linux, and Ubuntu Linux.

AlmaLinux

AlmaLinux issued several security notifications covering versions 8 through 10. Specific vulnerabilities include a use after free flaw in grub2 and integer truncation issues within libpng that could enable denial of service attacks. Other critical fixes address remote code execution risks found in applications like GIMP and libarchive to prevent exploitation by attackers. System administrators should install patches for tools including .NET, Python, and VIM immediately to maintain system integrity.

Debian GNU/Linux

Debian has issued multiple security bulletins highlighting serious risks within software packages like Chromium and ImageMagick. Exploits are already active in the wild so users must act quickly. Critical flaws exist within tools such as Ansible, OpenSSL, and Freetype that could allow attackers to execute code or access sensitive information. Administrators should prioritize updating these vulnerable packages to prevent denial of service conditions on Debian systems.

Fedora Linux

Fedora Linux versions 42 through 44 are receiving multiple security advisories to patch critical vulnerabilities across various software packages. Specific flaws include remote code execution risks within QGIS workflows alongside scripting issues found in database administration tools. Administrators must apply updates for Chromium, OpenSSH, and Python libraries immediately. Other affected software includes Vim and system services that could allow unauthorized access or denial of service events if left unpatched.

Oracle Linux

Oracle recently issued security advisories for multiple versions of its enterprise operating system ranging from seven through ten. Critical infrastructure components like system kernels and GRUB2 boot loaders are patched against serious vulnerabilities in this release. Beyond the core system files, other affected packages include SOS reporting capabilities, FreeRDP, MySQL databases, and timezone data tools across the platform. Security flaws involving memory corruption risks or potential privilege escalation issues are fixed within these widely used software components.

Qubes OS

he Qubes OS team recently issued security bulletin number 110 concerning a significant vulnerability in their system. Identified as XSA-480, this flaw allows for a use after free condition within paging structures referred to as EPT. Review the full text and accompanying cryptographic signatures provided below to ensure authenticity before applying any updates.

EPT security update for Qubes OS

Red Hat Enterprise Linux

Red Hat Product Security has issued a series of security advisories targeting various components within their Enterprise Linux ecosystem. Critical packages including the kernel, vsftpd, and grub2 require attention across multiple versions ranging from standard releases to specialized services. Although many updates carry a moderate severity rating, important patches exist for specific software like libpng and JBoss Enterprise Application Platform. Users on OpenShift platforms or running version 4 through 10 should prioritize applying these fixes immediately to ensure system safety.

Rocky Linux

Rocky Linux administrators have been notified of several important security patches covering multiple software components across the distribution. Critical updates specifically target version eight where issues within libpng and container tools like podman require immediate attention from system owners. Users should also install a low severity patch for libarchive alongside an update addressing vulnerabilities in the GIMP ecosystem labeled with specific release identifiers. Broader updates for Python libraries and virtualization packages are also required for versions eight through ten.

Slackware Linux

Slackware Linux has released updated expat packages for version 15.0 along with current branches to fix serious security problems. These patches target critical vulnerabilities that involve NULL pointers and could lead to infinite loops during processing. This update resolves multiple significant issues discovered inside the core processing functions of the software.

expat (SSA:2026-077-01)

SUSE Linux

OpenSUSE has issued multiple moderate security advisories for its Tumbleweed distribution affecting several ruby4.0-rubygem packages including actiontext and activemodel. Critical flaws within components like FreeRDP are being fixed to stop system exploits while development tools get moderate risk updates too. Immediate upgrades are required since severe issues could impact over thirty distinct CVEs across the Linux ecosystem if left unpatched. Updates also cover the stable Leap 15 series with patches targeting major vulnerabilities in enterprise products.

Ubuntu Linux

Ubuntu security teams have released several advisories to patch critical vulnerabilities found within the Linux kernel and supporting software packages. These flaws could allow unprivileged users to escape containers or manipulate system profiles on affected machines. Vulnerabilities span across various core applications including Flask, Python, and Snapd on both newer and older release tracks.

How to upgrade packages

This quick overview shows exactly what commands you need to run so the latest security patches and bug fixes actually make it onto your system without hunting down individual .deb or .rpm files.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Windows 11 KB5085516 (OS Builds 26200.8039 and 26100.8039) Out-of-band released