Today's Linux security updates hit nearly every major distribution, bringing critical fixes for kernel ABI changes in Ubuntu, privilege escalation flaws in Debian's XML parser, and a massive saturation of haproxy patches across RHEL 7 through 10. Fedora and Rocky Linux pushed urgent fixes for arbitrary code execution risks in SQLite's FTS5 module and untrusted ASN.1 file handling in PHP's cryptography toolkit, while openSUSE Tumbleweed addressed a high-severity memory safety vulnerability shared by sccache and wasm-bindgen. System administrators should prioritize the Ubuntu kernel updates for Azure and AWS instances immediately, as the new ABI will require third-party modules to be rebuilt before a reboot can complete cleanly. With AlmaLinux also patching .NET 8.0 for elevation of privilege issues and multiple distros releasing routine firmware and DNS security updates, running your package manager now is the best way to stay ahead of these CVEs.

Linux Security Roundup: Kernel ABI Changes, Arbitrary Code Execution, and a Haproxy Stampede

Today's Linux security updates demand immediate attention across nearly every major distribution. From kernel ABI shifts in Ubuntu to privilege escalation flaws in Debian's XML parser, the maintenance window is wide open. AlmaLinux, Debian, Fedora, RHEL, Rocky, SUSE, and Ubuntu all pushed fixes. Some of these aren't theoretical. You should treat them as urgent.

Debian's advisory this week targets two infrastructure staples you likely have running somewhere. The first addresses ironic, the OpenStack baremetal provisioning service. Three CVEs slip through its guard here, leaving the door open for API bypasses, data leaks, or arbitrary code execution if you feed it a malformed image. That combination sits uncomfortably close to any production cluster. The fix lands at version 1:29.0.5-0+deb13u3 for trixie.

The second patch tackles expat, the XML parsing library that quietly holds together half your config files. A UTF-16 decoding oversight treated low surrogates like high surrogates, which turns crafted XML into a reliable denial of service vector via an infinite loop and out of bounds read. It only trips up the 16-bit variant shipped in libexpat1, so 32-bit users get a secondary fix for a regression where anything over 2 GiB got flagged as an out of memory error. The corrected build sits at 2.8.3-1~deb13u1. If either package shows up in your dependency tree, upgrading is the obvious move before someone with too much free time gets ideas.

Fedora pushed a batch of security advisories late August, and the highlights are straightforward. If you are running Fedora 43 or 44, three libraries just got patched for active vulnerabilities. The PHP cryptography toolkit php-phpseclib finally addresses CVE-2026-44167, a denial-of-service bug triggered by feeding it malformed ASN.1 files. SQLite gets a double patch for FTS5 full-text search vulnerabilities that allowed arbitrary code execution and heap overflows, which is exactly the kind of issue you want to squash before feeding untrusted search indexes into your stack. Coturn, the TURN/STUN server most WebRTC deployments lean on, also lands CVE-2026-73215, closing a quota bypass and a few state-allocation leaks that would let a single client tie up your relay ports.

Ubuntu shipped another round of security patches, and if you are running one of the supported LTS releases, the update window is open. The bulk of the work lands in two kernel releases: one for Azure Confidential VMs on Ubuntu 20.04, and another for AWS instances on Ubuntu 24.04. Both ship with a new ABI, which means any third-party kernel modules sitting on your system will need to be rebuilt after a reboot. That step is usually where administration gets tedious, though dkms tends to smooth it over automatically. Keep in mind that you will need to reboot regardless of whether you use DKMS.

You should also pull the fix for Engrampa, the MATE archive manager. The older builds mishandled symbolic links during extraction, letting a crafted archive drop files anywhere your user has write access and run code under your credentials. It affects every LTS release back to 16.04. You can grab all three fixes through your normal package manager.

The Volume Players

RHEL just pushed another batch of security errata covering RHEL 7 through 10. If your patch queue is sitting at zero, you are about to get a very long run of "Important" ratings. Product Security only broke out a single "Moderate" entry in this haul, which belongs to nghttp2 on RHEL 8. The rest of the list tells you these are meaningful vulnerabilities that deserve a scheduled maintenance window, though you will still want to pull the CVSS scores from the advisory links for your exact setup.

haproxy dominates the volume, showing up in at least twelve separate entries across nearly every supported RHEL stream, including the SAP and telephony update channels. That kind of saturation is almost impressive. You will also see patches for the standard kernel and kernel-rt on RHEL 8, several kpatch modules targeting different kernel builds, .NET 9.0 and 10.0 on RHEL 9 and 10, libssh for RHEL 10, unbound across the board, and a couple of gstreamer plugin sets for RHEL 9. The 389-ds entries are scattered across RHEL 7 Extended Lifecycle Support and various RHEL 8 variant streams. Apply them, watch your dependency trees, and try to push them out before the CVE references catch up to the errata.

Rocky Linux issued a fresh batch of security errata this week, targeting versions 8, 9, and 10. The patch list covers expected heavy hitters like curl, bind, 389-ds-base, and libXfont2, plus a trio of GStreamer plugin families and a glib2 bump. Most entries land at "Important" severity, while the GStreamer and glib2 fixes sit at "Moderate." Each errata page points to its own CVE list with CVSS scores, so if your infrastructure runs any of these components, the decision to patch is already made.

openSUSE Tumbleweed just pushed four moderate security updates to the standard repositories. The patches target build tools and Python bindings, cleaning up eight distinct vulnerabilities across sccache, wasm-bindgen, and two Python HTTP/SAML libraries. sccache and wasm-bindgen share CVE-2026-25541, a memory safety flaw that jumps to an 8.7 severity rating on the newer CVSS 4.0 scale. The Python patches tackle older CVEs, mostly handling malformed input and session fixation in SAML assertions. If you run Tumbleweed, a standard zypper dup will pull everything down. The fact that two unrelated packages share the exact same CVE is mostly an upstream coincidence, but the fixes themselves are straightforward and well past their review window.

AlmaLinux pushed an Important security patch for .NET 8.0 on AlmaLinux 9, bumping the SDK to 8.0.130 and the runtime to 8.0.30. The update closes four vulnerabilities: a security feature bypass, an information disclosure leak, a denial of service flaw, and an elevation of privilege issue. You should roll this out on any AlmaLinux 9 host running the older SDK builds, particularly if those machines actually handle network traffic. The advisory reads like standard errata boilerplate, but the CVE list tells you exactly where the maintenance window should land.

Overview of updates

AlmaLinux

AlmaLinux pushed an Important security patch for .NET 8.0 on AlmaLinux 9, bumping the SDK to 8.0.130 and the runtime to 8.0.30. The update closes four vulnerabilities: a security feature bypass, an information disclosure leak, a denial of service flaw, and an elevation of privilege issue. You should roll this out on any AlmaLinux 9 host running the older SDK builds, particularly if those machines actually handle network traffic. The advisory reads like standard errata boilerplate, but the CVE list tells you exactly where the maintenance window should land.

Debian GNU/Linux

Debian rolled out two security patches this week targeting infrastructure staples you likely have running somewhere. The first one addresses ironic, the OpenStack baremetal provisioning service. Three CVEs slip through its guard here, leaving the door open for API bypasses, data leaks, or arbitrary code execution if you feed it a malformed image. That combination sits a bit uncomfortably close to any production cluster. The fix lands at version 1:29.0.5-0+deb13u3 for trixie.

The second patch tackles expat, the XML parsing library that quietly holds together half your config files. A UTF-16 decoding oversight treated low surrogates like high surrogates, which turns crafted XML into a reliable denial of service vector via an infinite loop and out of bounds read. It only trips up the 16-bit variant shipped in libexpat1, so 32-bit users get a secondary fix for a regression where anything over 2 GiB got flagged as an out of memory error. The corrected build sits at 2.8.3-1~deb13u1. If either package shows up in your dependency tree, upgrading is the obvious move before someone with too much free time and a sketchy XML feed gets ideas.

Fedora Linux

Fedora pushed a batch of security advisories late August, and the highlights are straightforward. If you are running Fedora 43 or 44, three libraries just got patched for active vulnerabilities. The PHP cryptography toolkit php-phpseclib finally addresses CVE-2026-44167, a denial-of-service bug triggered by feeding it malformed ASN.1 files. SQLite gets a double patch for FTS5 full-text search vulnerabilities that allowed arbitrary code execution and heap overflows, which is exactly the kind of issue you want to squash before feeding untrusted search indexes into your stack. Coturn, the TURN/STUN server most WebRTC deployments lean on, also lands CVE-2026-73215, closing a quota bypass and a few state-allocation leaks that would let a single client tie up your relay ports. The linux-firmware bump is just the usual monthly blob dump for AMD, Intel, Qualcomm, and Wi-Fi chips. No security holes in the firmware itself, just hardware support refreshes.

Red Hat Enterprise Linux

Red Hat just pushed another batch of security errata covering RHEL 7 through 10. If your patch queue is sitting at zero, you are about to get a very long run of "Important" ratings. Product Security only broke out a single "Moderate" entry in this haul, which belongs to nghttp2 on RHEL 8. The rest of the list tells you these are meaningful vulnerabilities that deserve a scheduled maintenance window, though you will still want to pull the CVSS scores from the advisory links for your exact setup.

haproxy dominates the volume, showing up in at least twelve separate entries across nearly every supported RHEL stream, including the SAP and telephony update channels. You will also see patches for the standard kernel and kernel-rt on RHEL 8, several kpatch modules targeting different kernel builds, .NET 9.0 and 10.0 on RHEL 9 and 10, libssh for RHEL 10, unbound across the board, and a couple of gstreamer plugin sets for RHEL 9. The 389-ds entries are scattered across RHEL 7 Extended Lifecycle Support and various RHEL 8 variant streams. Apply them, watch your dependency trees, and try to push them out before the CVE references catch up to the errata.

Rocky Linux

Rocky Linux issued a fresh batch of security errata this week, targeting versions 8, 9, and 10. The patch list covers expected heavy hitters like curl, bind, 389-ds-base, and libXfont2, plus a trio of GStreamer plugin families and a glib2 bump. Most entries land at "Important" severity, while the GStreamer and glib2 fixes sit at "Moderate." Each errata page points to its own CVE list with CVSS scores, so if your infrastructure runs any of these components, the decision to patch is already made. Rocky Linux 8 gets focused attention on pcp and the legacy 389-ds:1.4 module, while 9 and 10 absorb the bulk of the network and media library fixes. It is a standard security sweep, but the spread across three releases means you probably want to cycle through your repos before anything else on your to-do list.

SUSE Linux

openSUSE Tumbleweed just pushed four moderate security updates to the standard repositories. The patches target build tools and Python bindings, cleaning up eight distinct vulnerabilities across sccache, wasm-bindgen, and two Python HTTP/SAML libraries. sccache and wasm-bindgen share CVE-2026-25541, a memory safety flaw that jumps to an 8.7 severity rating on the newer CVSS 4.0 scale. The Python patches tackle older CVEs, mostly handling malformed input and session fixation in SAML assertions. If you run Tumbleweed, a standard zypper dup will pull everything down. The fact that two unrelated packages share the exact same CVE is mostly a upstream coincidence, but the fixes themselves are straightforward and well past their review window.

Ubuntu Linux

Ubuntu shipped another round of security patches and if you are running one of the supported LTS releases, the update window is open. The bulk of the work lands in two kernel releases: one for Azure Confidential VMs on Ubuntu 20.04, and another for AWS instances on Ubuntu 24.04. Both ship with a new ABI, which means any third-party kernel modules sitting on your system will need to be rebuilt after a reboot. That step is usually where administration gets tedious, though dkms tends to smooth it over automatically. You should also pull the fix for Engrampa, the MATE archive manager. The older builds mishandled symbolic links during extraction, letting a crafted archive drop files anywhere your user has write access and run code under your credentials. It affects every LTS release back to 16.04. You can grab all three fixes through your normal package manager.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y