Distributions across the board just shipped security updates, tightening the kernel network stack, updating the Go runtime, and patching critical container tooling flaws. AlmaLinux, Oracle Linux, and SUSE pushed Important advisories this week, closing dozens of CVEs that span heap overflows in rsyslog, race conditions in netfilter, and privilege escalation paths in xrdp and apptainer. Debian's LTS team delivered fourteen CVE fixes for xrdp on Bullseye and Bookworm, while Fedora 44 overhauled the Python cryptography stack and patched the local Bluetooth discovery vector. Sysadmins should prioritize the Go runtime patches and kernel network updates at their next maintenance window, as older XML parsers and legacy mingw OpenSSL builds continue to collect dust and predictable vulnerabilities.

Today's Linux Security Roundup: Kernel patches, Go runtime fixes, and a heavy wget update

If your infrastructure runs anything from the Linux kernel to container tooling, the maintenance window is right now. Distributions across the board just shipped security updates, and the theme this cycle is straightforward. Tighten the network stack, update the Go runtime, and stop trusting your input parsers.

AlmaLinux delivered five advisories today, and the two Important flags are doing the heavy lifting. The stock Go compiler climbed to 1.26.7, closing six CVEs that mostly tighten denial-of-service surface area in URL parsing, TLS handling, and HTML templating. Next, the AlmaLinux 9 kernel absorbed twelve security patches targeting the network stack, netfilter modules, and input drivers. It also quietly fixed Intel C-state idle reporting and SCTP session crashes. The remaining three advisories cover libxml2, assertj-core, and Apache httpd at moderate to low severity. Ignoring a buffer overflow in xmlcatalog or an XXE flaw in a testing framework still leaves predictable attack vectors wide open. Apply these at your next maintenance window.

Oracle Linux closed out thirteen CVEs for OL9 with a kernel bump to 5.14.0-687.42.1. The fixes span memory overreads in i2c stubs and Synaptics touchpad drivers, plus race conditions in netfilter and SCTP socket handling. There is also some certificate housekeeping, a disabled UKI signing toggle, and module signing keys getting baked into the kernel trust store. You probably will not notice the difference until something breaks, and then you will be glad it went in. OL8 follows the same playbook with eight CVEs in the 4.18.0-553.158.1 kernel, plus a low-severity mingw-openssl update clearing out a buffer overread in SSL_select_next_proto. Old mingw OpenSSL builds tend to collect dust and bugs at the same rate. Apply it.

SUSE's update batch leans heavily on infrastructure and container tooling. You get two separate rsyslog bumps closing the same heap overflow in the RainerScript engine, two podman rebuilds against a newer Go release, and a crowded wget update that plugs five distinct holes spanning server-side request forgery to integer overflows. The python310 and apptainer patches for SLE 15 SP4 and SP6 block tar extraction path traversal and confinement bypasses. That is the kind of issue that tends to make incident response teams sweat. If you are pinned to older branches, the wget, gzip, and wicked fixes are restricted to the fresh openSUSE Leap 16.0 release.

What To Apply First

Debian's LTS team pushed a security patch for xrdp that slaps fixes onto fourteen separate CVEs. If you are running an RDP server on Debian 11 or 12. The flaw set is a mixed bag. You get heap buffer overflows, out-of-bounds reads, a privilege escalation path straight to root, and crafted-packet vectors that can freeze the CPU. The patched packages are 0.9.21.1-1~deb11u4 for Bullseye and 0.9.21.1-1+deb12u3 for Bookworm. Fedora 44 shipped another maintenance push, this time focusing on the Bluetooth stack and the Python dependency chain. BlueZ got patched against two bugs that can crash bluetoothd or hand an attacker a foothold during local discovery. The cryptography stack jumped to 50.0.0, and both pyOpenSSL and python-pynitrokey lifted their dependency pins to ride along with the fix for CVE-2026-69247. Fedora maintainers Bastien Nocera and Jeremy Cline handled the queue, and the results are exactly what you want from a routine cryptography overhaul. postgresql16-anonymizer rounds out the queue with patches for privilege escalation and hash brute-force issues, while rust-h2 quietly addresses a low-severity HTTP/2 flaw. Pull everything down in one shot using dnf upgrade --advisory with the provided IDs.

Rocky Linux 10 landed a moderate update for libxml2. The official errata page keeps the specific CVEs and CVSS scores locked behind the advisory links. You will need to dig through there yourself. Apply it. Older XML parsers tend to collect parsing glitches that turn into denial of service or worse if fed the wrong kind of input.

Keep in mind that the Go runtime fixes across AlmaLinux, Oracle, and SUSE are non-negotiable this cycle. The container tooling updates should be tested in staging first if you run them in production. Head here to pull the official advisory pages for each distribution.

The Updates in Detail

AlmaLinux

AlmaLinux just pushed multiple security errata, and if your infrastructure runs anything from the Go compiler to the Linux kernel, it is time to patch. The batch leans heavily on internal maintenance rather than flashy zero-days, which is exactly the kind of boring update sysadmins prefer. The two Important advisories carry the heaviest load. Go gets bumped to 1.26.7 alongside six separate CVEs that mostly tighten denial-of-service surface area in URL parsing, TLS handling, and HTML templating. The AlmaLinux 9 kernel takes a thoroughgoing approach with twelve security patches across the network stack, netfilter modules, and input drivers, plus a handful of stability fixes for Intel C-state idle reporting and SCTP session crashes. The remaining three advisories cover libxml2, assertj-core, and Apache httpd at moderate to low severity. Ignoring a buffer overflow in xmlcatalog or an XXE flaw in a testing framework still leaves predictable attack vectors wide open. Apply these patches at your next maintenance window.

Debian GNU/Linux

Debian's LTS team just pushed a security patch for xrdp that slaps fixes on fourteen separate CVEs. The flaw set is a mixed bag: heap buffer overflows, out-of-bounds reads, a privilege escalation path to root, and a couple of crafted-packet vectors that can freeze the CPU or drop the session. The patched builds are 0.9.21.1-1~deb11u4 for Bullseye and 0.9.21.1-1+deb12u3 for Bookworm.

Fedora Linux

Fedora 44 shipped another round of security patches, and this batch focuses on keeping the Bluetooth stack and Python dependency chain from catching fire. The headline act is BlueZ, which just got patched against two bugs that can crash bluetoothd or hand an attacker a foothold during local Bluetooth discovery. If your workflows rely on Python, the cryptography stack gets a major overhaul: python-cryptography jumps to 50.0.0, and both pyOpenSSL and python-pynitrokey lift their dependency pins to ride along with the fix for CVE-2026-69247. postgresql16-anonymizer rounds out the security queue with patches for privilege escalation and hash brute-force issues, while rust-h2 gets a minor version bump that quietly addresses a low-severity HTTP/2 flaw. You can pull everything down in one shot using dnf upgrade --advisory with the provided IDs. It is a solid maintenance push, and ignoring it would just leave your Bluetooth radio and dependency graph hanging.

Oracle Linux

Oracle just pushed a batch of security and maintenance updates for OL9 and OL8. If you run Oracle Linux 9, the kernel jumped to 5.14.0-687.42.1. The advisory closes out 13 CVEs ranging from memory overreads in i2c stubs and Synaptics touchpad drivers to race conditions in netfilter and SCTP socket handling. There is also some certificate housekeeping, a disabled UKI signing toggle, and module signing keys getting baked into the kernel trust store. The certificate changes suggest Oracle is still fine-tuning its Secure Boot posture. You probably will not notice the difference until something breaks, and then you will be glad it went in.

If you are still on OL8, you get two packages. The kernel bumps to 4.18.0-553.158.1 and patches 8 CVEs. The fixes look familiar: the same netfilter races, SCTP locking issues, and Synaptics bounds checking that show up across both kernels. A few OL8-specific ones cover nvmet heap reads, Selinux TCP Fast Open permissions, and iSCSI CHAP validation. You will also see the standard certificate refresh and UKI signing adjustments here.

Then there is the low-severity mingw-openssl update for OL8. Version 1.0.2k-4 clears out a single buffer overread in SSL_select_next_proto (CVE-2024-5535). Old mingw OpenSSL builds tend to collect dust and bugs at the same rate. You should probably just apply it.

Rocky Linux

Rocky Linux 10 picked up a moderate security update for libxml2. The advisory notice is about as sparse as it gets, since the provided text does not list the affected CVEs or spell out the patch notes. You will need to head over to the official errata page to pull the CVSS ratings and the actual vulnerability details. If you are still running Rocky 10, you should probably apply it. Older XML parsers tend to collect parsing glitches that turn into denial of service or worse if fed the wrong kind of input.

SUSE Linux

Another round of SUSE security patches hit the mirrors, and if you are managing any of these hosts, you should run zypper patch before you move on to other tasks. The batch leans heavily on infrastructure and container tooling, which is about as exciting as it sounds, but that is precisely why missing these leaves doors open. You get two separate rsyslog bumps closing the same heap overflow in the RainerScript engine, two for podman rebuilt against a newer Go release, and a crowded wget update that plugs five distinct holes spanning server-side request forgery to integer overflows.

The wget package is doing the heavy lifting here. Five CVEs in a single bump usually means upstream has been actively scrubbing input validation, and you are better off having those fixes in place than trusting your own network handlers. The gzip and wicked fixes are restricted to the fresh openSUSE Leap 16.0 branch, so older releases stay untouched for now. If you are pinned to SLE 15 SP4 or SP6, the python310, rsyslog, and apptainer patches are your primary targets. The apptainer fix specifically blocks tar extraction from writing outside the destination directory, which is the kind of bypass that tends to make incident response teams sweat. Apply what matches your stack.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y