This morning's Linux security roundup shows the same vulnerabilities appearing across nearly every major distro, with Brotli's CVE-2026-111497 alone patching Fedora, Oracle, and all supported Ubuntu releases in one motion. Grafana is the standout Critical, flagged by Oracle, Red Hat, and AlmaLinux on RHEL 9 even though the same package gets a lower rating on other channels. Kernels need the real reboots, especially AlmaLinux's Dirty Frag "Fragnesia" privilege-escalation fixes, while SUSE's python-social-auth-core auth bypass is the flaw worth worrying about most. Patch Brotli, Grafana, and the kernels first, then handle the rest as housekeeping.

Linux distros pile on security fixes today, and several patch the exact same bugs

Brotli, Grafana, and PostgreSQL show up across nearly every distribution. Here's what actually needs a reboot.

The most striking thing about today's Linux security updates isn't the volume. It's how many of the same vulnerabilities are showing up across multiple distros at once. Fix Brotli once, and you've quietly patched Fedora, Oracle Linux, and every supported Ubuntu release in a single motion.

This roundup covers AlmaLinux, Debian, Fedora, Oracle Linux, Red Hat Enterprise Linux, Rocky, SUSE, and Ubuntu. If you're still running unpatched, a lot of it is a single dnf update or apt upgrade away. Fedora shipped its batch on October 26 through 27. Ubuntu's two security notices went out on October 26. Everything else landed in the same window.

Brotli is the clearest example. CVE-2026-111497 is an out-of-bounds flaw in the lossless compression library that quietly backs a big chunk of web traffic. It shows up in Fedora 45, Oracle Linux 8, 9, and 10 (hitting Node.js 22 and 24 along the way), and on Ubuntu 22.04, 24.04, 26.04, and 26.10. That's a lot of boxes to cover for one fix. Brotli has arguably been this year's most well-traveled bug, surfacing in package managers from here to Timbuktu.

The bugs that refuse to stay put

Grafana is the one to clock first. Oracle (ELSA-2026-89744) and Red Hat (RHSA-2026:89744) both marked their updates Critical, and both point at RHEL 9. The funny part is the inconsistency, since that same package lands at Important on RHEL channels you might not be watching. AlmaLinux flagged its Grafana drop as Critical for RHEL 9 too. Not something to shrug off, though the actual bug, information disclosure in Unified Alerting, is more of a leak than a foot in the door.

PostgreSQL is the other recurring name. AlmaLinux handed out a pile of advisories covering an MD5 timing channel, an integer-overflow out-of-bounds read, and symlink hijacking across builds 12, 13, 15, 16, and 18. Oracle layered its own on top: pgvector's out-of-bounds write during IVFFlat index builds (CVE-2026-103484) allows arbitrary code execution, landing on both the 16 and 18 builds. If you're running vector search, that's the one worth your attention.

Here's a quick detour before I go further: Brotli was designed by Google engineers Jyrki Alakuijala and Jean-Marc Valin, the same people behind the Opus audio codec. The format is so compact that browsers quietly route megabytes through it without anyone ever thinking about it. Which is precisely why a decoder bug cuts so deep.

What actually needs a reboot

Not every fix here wants a maintenance window. A few do.

AlmaLinux's kernel batch is the reason to schedule downtime. The "Dirty Frag" privilege-escalation family keeps circling back: CVE-2026-46300, nicknamed "Fragnesia," and the underlying CVE-2026-43284 appear across AlmaLinux 8, 9, and 10, alongside a separate bug that let unprivileged users read root-owned files. That's a genuine reboot-and-move-on situation. Kernels also dropped in Fedora, Oracle, RHEL, and Rocky, though those read as normal volume rather than dramatic holes.

SUSE has two that pull ahead of the crowd. python-social-auth-core is the scary one: five vulnerabilities including account takeover via unverified SAML responses and an authentication bypass from a missing signature check in the VK App backend. Those are the exact bugs that get someone compromised on a perfectly ordinary afternoon. rclone is the volume story, jumping to 1.75.1 and absorbing a dozen CVEs plus a mountain of non-security backlog work. The zip-slip path-traversal half is the part that actually matters.

Ubuntu's nginx notice deserves a careful read. The SSL session ticket flaw lets someone forge client sessions and skip certificate verification entirely, which is a far nicer outcome for an attacker than most of these CVEs manage. The catch is version granularity: the two newest Ubuntu releases pick up all five issues, while 24.04 and 22.04 LTS only get three. If you're sitting on an older LTS, you might be leaving holes behind.

Keep in mind that the browsers came through too. Debian's Thunderbird update yanks the client to the 153.x line since 140.x reached end of support, bringing 62 CVEs. Firefox and Thunderbird across the Fedora and AlmaLinux roundups carry anywhere from 40 to 62. That's just how web engines age over a quarter.

Fedora deserves a specific mention for doing the boring thing well. A faster-hex version bump to 0.10.1 fixed RUSTSEC-2026-0306, an unsoundness that only bites on x86 when AVX2 is switched on. One root cause is why Helix, gitui, StGit, and a pile of unrelated tools all got the same treatment. Let dnf handle them. Don't eyeball each one.

There are a couple of caveats worth flagging.

Rocky Linux's advisory for container-tools:rhel8 (RLSA-2026:89760) drags in an intimidating list, podman plus cockpit-podman, crun, slirp4netns, fuse-overlayfs, and netavark, but the text doesn't actually tell you what's fixed. You get the CVEs and a nod about CVSS scores, and the specifics stay behind the links. That's standard for a security advisory, just not handy when you're trying to decide whether to reboot before your coffee.

And on AlmaLinux specifically: the advisory emails are dated October 2026, which lands ahead of today. That alone should make you raise an eyebrow. Sanity-check the advisory IDs and links against what your package manager reports before you start scheduling reboots.

SUSE's Go rebuilds of cosign, kubernetes, and rekor are mechanical, recompile against a patched Go and ship. Cheap insurance, worth it, but don't expect drama.

The bottom line: patch Brotli, Grafana, and the kernels, and you've handled most of what matters. The rest is housekeeping.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux shipped a wide batch of security errata across AlmaLinux 8, 9, and 10. Skim enough of these advisory emails and the shape of the batch becomes obvious pretty fast.

The kernel claims the biggest slice of the pie, and not in an exciting way. Driver fixes, race conditions, and use-after-free patches trickle out across the regular, RT, and 6-series builds. One cluster is worth a reboot though: the "Dirty Frag" privilege-escalation family shows up repeatedly. CVE-2026-46300 (nicknamed "Fragnesia") and the underlying CVE-2026-43284 appear in advisories for all three major versions, alongside a separate bug that let unprivileged users read root-owned files. If you run any of these kernel builds, that's the reason.

The browser side is the other loud group. Firefox and Thunderbird each pulled in their own advisory loaded with sandbox-escape and use-after-free fixes, while webkit2gtk3 collected its usual pile of memory-corruption and info-disclosure CVEs. It looks like a lot of numbers, but that's just how these web engines age over a quarter.

The Java updates are mostly a paperwork exercise. OpenJDK 8, 11, 17, and 21 all picked up the same set of quarterly JDK fixes, so you're getting the same eight or so CVEs retyped across versions rather than four distinct fixes. And a couple of housekeeping notes: the only Critical rating in this set lands on the Grafana update for AlmaLinux 9 (AL2026:89744), so dashboards should top your queue. Nearly half these advisories are duplicated or near-duplicated across modules or versions, so you don't need to chase every single one.

One thing that makes you raise an eyebrow: these emails are all dated October 2026. Since that's ahead of the present, you may want to sanity-check that the advisory IDs and links actually match what your package manager reports before you start scheduling reboots.

Debian GNU/Linux

Debian's long-term support teams and Freexian pushed a fresh round of security patches, and a few of them are worth applying before you finish your coffee.

The standout is a hefty openjdk-17 update carrying 36 CVEs. That batch spans denial of service, information disclosure, unauthorized access, and sandbox bypasses. If you're running anything Java-based on an older Debian box, this is the one to jump on. It ships under DLA-4861-1 for bookworm, with the same patch mirrored under Freexian's ELA-1863-1 for bullseye.

Thunderbird got similar treatment. This update yanks the client up to the 153.x line, since the 140.x series has reached end of support, and brings its own pile of fixes with it. That's 62 CVEs worth scanning through, landed under DLA-4863-1 for bookworm.

The rest of the batch is smaller but still worth a look. libdatetime-timezone-perl pulled in a fresh tzdata 2026e timezone database, tracked back to stretch. Inkscape was patched against a local file disclosure, where a crafted SVG with nasty xi:include tags could read files off the machine. swupdate, the framework used for embedded system updates, now closes a privilege escalation and a signature validation bypass. Valkey, the in-memory key-value store, picked up fixes for denial of service with some cases that could allow arbitrary code execution. And two separate GStreamer updates both target that Ogg demuxer buffer overflow, with the newer-build patch also fixing a NULL pointer crash in the RTSP layer.

Fedora Linux

Fedora pushed a batch of security patches out to Fedora 43, 44, and 45 (RC) over October 26-27, and nearly all of it installs with the usual dnf command. The interesting part is not any single fix but the pattern behind them.

A big chunk of these updates exist because of one shared dependency. Helix, gitui, StGit, and friends all got rebuilt on a faster-hex version bump to 0.10.1, fixing RUSTSEC-2026-0306, an unsoundness problem that only actually bites on x86 and x86_64 when AVX2 is switched on. That single root cause is why you are seeing a pile of tools that have nothing to do with each other all getting the same treatment. You can just let dnf handle them rather than eyeballing each one.

The updates that stand on their own matter more if they touch things you actually run. NSD took in fixes from simdzone-0.2.7 covering four CVEs, all credited to Palo Alto Networks. Plack got a multi-part security patch to its Perl web stack, including a memory leak and a couple of things that could trip up request routing. Python for Windows (mingw-python3) jumped to 3.11.17 with six CVEs attached, so that is the largest individual pile if you are packaging Windows Python. Brotli 1.2.1 closes an out-of-bounds write, while libical and unshield each picked up their own out-of-bounds read fixes.

The two kernel releases are standard 7.2.12 stable builds. There is a headset misdetection fix for one Acer laptop and a couple of Fedora config tweaks. Nothing anyone will write home about, but it is the normal housekeeping. WebGTK on 44 is mostly performance and crash work, though the backdrop-filter compositing tweak is one you might genuinely notice with a desktop full of translucent windows.

Oracle Linux

Oracle Linux just shipped another broad errata run, and this one reaches across versions 7 through 10. That's 36 advisories covering everything from mail transport to the kernel, with the expected buffet of buffer overflows and authentication holes. Most of it is patch-and-forget, but a few entries are worth your attention specifically.

The cleanest story is the Brotli decoder flaw, CVE-2026-111497. It lives in a system library and then haunts Node.js 22 and 24, so the same vulnerability gets patched across OL 8, 9, and 10. Fix the library and three packages go quiet at once. Firefox on OL 9 took the full drubbing, landing 48 CVEs as part of the 153.5.0 ESR bump. That's a long list, though browser CVEs tend to be a pile of small layered fixes rather than one dramatic hole. Apache's httpd on OL 10 is the other pile-on, carrying 11 CVEs that stretch from oversized Host headers to response smuggling. If you're running Apache there, this isn't optional. The OL 10 kernel (6.12.0-211.68.1) is mostly about volume, tucking 18 listed CVEs plus a wider set of fixes into a version bump while also swapping driver signing keys and UKI signing, which tends to bite people running odd hardware.

A couple of things you might not expect. PostgreSQL's pgvector extension got hit by an out-of-bounds write during IVFFlat index builds (CVE-2026-103484) that allows arbitrary code execution, and it landed on both the 16 and 18 builds. The ca-certificates updates on OL 8 and OL 9 read as Critical even though they mostly reshuffle which root certificates ship by default, retiring emSign and AAA Services roots and adding a batch of Actalis and Telia ones. Routine, until it's marked Critical and touching your trust store.

Severity-wise this is a mostly-Important drop. You've got 24 Important advisories, 8 Moderate, and 4 Critical. The four Criticals are the ones to actually explain to a security team about: grafana on OL 9, ca-certificates on both OL 8 and 9, and unbound on OL 7.

Red Hat Enterprise Linux

Red Hat put out another roundup of security errata, and this one lands at a size you have to set aside for. It doesn't span every RHEL channel, but it reaches enough of them that dismissing it outright is a gamble. By severity this round is mostly Important: 62 advisories sit there, three are Critical, and nine land at Moderate.

The Criticals are the ones worth opening a terminal for first. Grafana gets a Critical (RHSA-2026:89744) pointed at plain RHEL 9, which is a little funny because the same tool also shows up at Important level on two other channels, so patching it means handling two different severity ratings for one package. Webkit2gtk3 picks up a Critical on RHEL 9.6 Extended Update Support, a legacy line, and idm:DL1 (the Samba identity module) takes Critical on RHEL 8.6's advanced and extended channels. Those three are the ones to reorder your maintenance window around.

Everything Important should still get applied, but a handful of packages are clearly the heavy lifters here. Git-lfs alone picked up five advisories, rhc six, and ignition, flatpak, and a Go debugger each took four. Kernel updates appear twice at Important (RHEL 8 and RHEL 9.8 EUS), with kernel-rt grabbing one for RHEL 8, so virtualization and real-time stacks aren't left out. You will also find the usual container tooling (podman, buildah, skopeo, osbuild-composer), browser-adjacent bits (brotli, xdg-dbus-proxy), and two MicroShift releases (4.22.20 and 4.21.40) riding along.

Rocky Linux

Rocky Linux pushed a fresh round of updates for version 8, and the most conspicuous one lands on your container toolchain. The container-tools:rhel8 update (RLSA-2026:89760) drags in an almost intimidating list of packages - podman, cockpit-podman, crun, slirp4netns, fuse-overlayfs, netavark, udica, aardvark-dns, plus a pile of modules around them. If you run anything container-ish on a Rocky 8 box, this likely ends up at the top of your patch queue.

The kernel got its own pass (RLSA-2026:89083), and the real-time variant, kernel-rt, got one too (RLSA-2026:89082). The RT patch matters only if you run a low-latency workload, so it may not concern you - but the standard kernel update is worth a look regardless.

Here's the honest part: the advisory text doesn't actually tell you what's fixed. You get the CVE list and a nod that every vulnerability carries a CVSS severity score, but the specific bugs stay behind the links rather than landing in the summary. It's standard for a security advisory, just not especially useful if you're trying to decide whether to reboot before your coffee. Follow the errata link and you'll find the details.

SUSE Linux

SUSE released a batch of security patches that looks like a grab bag at first glance, but it sorts into two kinds of work: mechanical rebuilds and full restorations. Either way, if you run any of these you want to install them.

The quiet category is the cluster of Go packages rebuilt against the latest Go security release. cosign, kubernetes, kubernetes-old, and rekor all got exactly this treatment. That means a fairly mechanical operation: take the existing binary, recompile it against a patched Go, ship it. No new features, but the runtime underneath had holes, so this is the cheap insurance you want already on the shelf.

Then there is rclone, and this one carried a lot. It jumped to 1.75.1 and absorbed a dozen vulnerabilities alongside a mountain of smaller fixes. The security fixes cover zip slip path traversal in untrusted zips, archive entries escaping the listing directory, headers leaking to other hosts across redirects, and a batch of Go stdlib CVEs (net/url, html/template, crypto/tls, net/http, and a few more). But read past the headline and most of the volume is just plain work: modtime bugs, MD5 hashes silently dropping on Azure, truncated uploads reported as success across a dozen backends, memory leaks on long-running rcd. It reads less like a security advisory and more like one patient maintainer clearing a backlog. The zip slip half is the part that actually worries me.

python-social-auth-core deserves a closer look. Five vulnerabilities, and they are the worse kind: account takeover via unverified SAML responses, authentication bypass from a missing signature check in the VK App backend, session fixation, and login CSRF. These are the exact bugs that get someone compromised on an ordinary afternoon. Five CVEs in an authentication library is not something to shrug off.

squid comes in with eight vulnerabilities plus two more security fixes, which is a lot for a proxy. The spread is typical web-server fare: out-of-bounds reads in ICP handling, denial of service in request handling, an input-validation bug, and a use-after-free in collapsed forwarding. CVE-2025-62168 is the one that quietly hands real credentials to a trusted client, which defeats the whole point of putting authentication in front of the proxy.

krb5 is quieter. Two denial-of-service CVEs, both triggered by malformed input (a bad PAC in S4U2Proxy requests, crafted forwarded credentials). Rated moderate, since you cannot steal anything from a crashed auth server, only stall it. Nobody still enjoys an outage blamed on Kerberos.

python-weasyprint gets the smallest touch, a single SSRF CVE rated moderate. It renders HTML to PDF, so SSRF means it can be nudged into hitting internal endpoints you never meant it to reach. Worth the update, just not a fire drill.

python-nltk is its own beast: eight vulnerabilities, and the fix is really a cascade of version bumps (3.9.1 through 3.10.3) stacked into a single patch. That sweeps in path traversal, sandboxing of the Stanford JAR execution, ReDoS in the tokenizer, and older issues that had been sitting around. Updating the library is fine, just know you are pulling in a lot of historical fixes at once.

Ubuntu Linux

Two Ubuntu Security Notices went out on October 26, 2026, and both are worth a patch cycle.

First is Brotli, the lossless compression format that quietly backs a good chunk of web traffic without anyone bothering to notice. It mishandled certain compressed streams, opening the door for a remote attacker to crash the process or run arbitrary code. That's CVE-2026-111497, and it lands on all four supported releases: 22.04, 24.04, 26.04, and 26.10.

nginx is the one to watch. Five separate issues got fixed here, and two of them are the ones you'll actually care about. The SSL session ticket flaw lets someone forge client sessions and skip certificate verification entirely, which is a better outcome for an attacker than most of these CVEs manage. The HTTP/3 hole injects data into proxied requests. The other three crash the server or allow arbitrary code execution. Worth knowing that the HTTP/3 fix only reaches the two newest releases, and the SSL one skips 22.04 LTS altogether.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y