Linux Security Roundup for Week 15, 2026

Security 10942 Published 2026-04-12 08:25 by Philipp Esselbach

News

This week brings a massive wave of patches across major distributions, with Red Hat and its clones facing the most urgent critical vulnerabilities in their Cockpit web interface. Administrators must prioritize these fixes immediately because memory handling flaws can allow remote code execution without authentication on newer platforms. Debian, Ubuntu, Fedora, SUSE, and Slackware users also need to update browsers and kernels to prevent potential security breaches on their networks today. Ignoring these advisories is a fast track to system compromise, so run the update commands for your distribution without delay.

Apply these critical Linux security updates before attackers scan your network

This week brings a massive wave of patches across the major distributions, and ignoring them is a fast track to system compromise. Administrators need to prioritize the kernel and application fixes immediately because memory handling flaws can allow remote code execution without authentication. The following overview breaks down exactly which Linux security updates require immediate attention for AlmaLinux, RHEL, Debian, Ubuntu, and others.

Enterprise distributions face critical Cockpit vulnerabilities

Red Hat Enterprise Linux users have the most urgent task this week due to a critical flaw in the Cockpit web interface. An unauthenticated attacker could potentially execute remote code on newer platforms if they do not apply the SSH command-line argument injection fix found in RHSA-2026:7382 through 7384. This specific issue stands out because it bypasses standard login procedures entirely, making it a priority over general maintenance tasks. The same kernel and crun security updates affecting AlmaLinux also appear here for versions six through ten, so system owners should install these patches promptly to prevent denial of service attacks.

Rocky Linux administrators across versions eight through ten must also address critical issues within essential software like the kernel and OpenSSH immediately. Users should verify their specific OS version since NodeJS versions 22 and 24 face critical problems on release nine specifically, requiring a targeted upgrade path rather than a blanket update. The updates for Fontforge and Vim are less urgent but still need regular maintenance soon enough to avoid moderate risks in utility functions.

Debian and Ubuntu users must patch browsers and kernels

Ubuntu has released numerous security notices to fix critical flaws found within the Linux kernel and various other software packages. Legacy versions on older distributions also remain vulnerable to memory buffer exploits that allow unauthenticated attackers to access sensitive data beyond just standard user privileges. Patches for OpenSSL and Django are also critical for maintaining security across all supported distributions, so system administrators must prioritize applying these fixes now to prevent potential security breaches on their networks today.

Debian has issued a wave of new security advisories targeting popular software such as Valkey, Tor, and Apache Traffic Server. Many of these patches address dangerous vulnerabilities including SQL injection flaws or denial of service risks found in Dovecot and Python-Tornado, while others fix memory disclosure issues. One update even fixes a regression in the dovecot package causing authentication errors on Bookworm systems. System administrators must prioritize applying these patches immediately because they are essential to resolving the critical code execution threats present in Firefox ESR and PostgreSQL across all affected Debian distributions.

Fedora and SUSE require prompt action for rolling releases

Fedora has issued several security notifications requiring users on versions 42 and 43 to apply critical patches for their systems. Administrators must act quickly on specific risks like a dangerous double-free vulnerability in giflib or flaws within Nextcloud version 33. Updates for other tools such as BIND, OpenSC, and Cockpit could potentially lead to memory corruption or privilege escalation issues if ignored by the user base.

SUSE has released numerous security updates to address vulnerabilities across both openSUSE Tumbleweed and SUSE Linux Enterprise distributions. Administrators must prioritize critical patches found within OpenSSL 3 as well as the Linux Kernel Live Patch for version 15 SP5. Several other important advisories cover fixes for ImageMagick, Python, and BIND while resolving risks on various service packs. Moderate vulnerabilities in packages like corosync were also fixed to ensure system stability for Tumbleweed users.

Slackware Linux Security Team recently patched security issues in Mozilla Thunderbird and Firefox for version 15.0 or the current development branch. Users should upgrade immediately to reach version 140 for safety since use-after-free errors could potentially corrupt chunk data inside specific functions within libpng. Critical flaws involving DANE client code and CMS processing are resolved through new OpenSSL packages available now.

The Security Updates in Detail

Here is an in-depth overview of the updates recently released for AlmaLinux, Debian GNU/Linux, Fedora Linux, Red Hat Enterprise Linux, Rocky Linux, Slackware Linux, SUSE Linux, and Ubuntu Linux.

AlmaLinux

Recent notifications from AlmaLinux warn of moderate security issues affecting multiple operating system versions. Users on version eight specifically need to update their kernels and crun software immediately because these patches fix memory handling flaws and prevent denial of service attacks. Additional advisories address critical flaws in applications ranging from database servers to font editors like FreeRDP and Nginx for versions eight through ten. These vulnerabilities allow attackers to execute arbitrary code on vulnerable systems if patches are not applied quickly.

Debian GNU/Linux

Fedora Linux

Red Hat Enterprise Linux

Red Hat has issued multiple security updates addressing vulnerabilities within its Enterprise Linux systems across release versions ranging from six to ten. These advisories target flaws in widely used tools such as fontforge, vim, and the kernel carrying moderate or important severity ratings with some critical issues noted throughout the collection. A serious injection vulnerability in Cockpit allows attackers to potentially execute remote code without authentication on newer platforms. Administrators should prioritize these fixes immediately.

Rocky Linux

Rocky Linux administrators across versions eight through ten must install multiple security patches to address known vulnerabilities immediately. Critical issues within essential software like the kernel and OpenSSH require urgent attention from anyone managing production environments today. Some advisories also target moderate risks found in utilities such as Vim or Fontforge that still need regular maintenance soon enough. Users should verify their specific OS version since NodeJS versions 22 and 24 face critical problems on release nine specifically.

Slackware Linux

Recent updates from the Slackware Linux Security Team patch security issues in Mozilla Thunderbird and Firefox. Users on version 15.0 or the current development branch should upgrade immediately to reach version 140 for safety. Libpng requires a separate update as well because use-after-free errors could potentially corrupt chunk data inside specific functions. Critical flaws involving DANE client code and CMS processing are resolved through new OpenSSL packages available now.

SUSE Linux

Ubuntu Linux

Ubuntu has released numerous security notices to fix critical flaws found within the Linux kernel and various other software packages. Legacy versions on older distributions also remain vulnerable to memory buffer exploits that allow unauthenticated attackers to access sensitive data. Beyond kernel updates, patches for OpenSSL and Django are also critical for maintaining security across all supported distributions. System administrators must prioritize applying these fixes now to prevent potential security breaches on their networks today.

How to upgrade packages

This quick overview shows exactly what commands you need to run so the latest security patches and bug fixes actually make it onto your system without hunting down individual .deb or .rpm files.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all

Trisquel GNU/Linux 12.0 LTS released