Ubuntu, Red Hat, SUSE and other major Linux distros shipped another wave of security patches dominated by kernel and browser fixes. Oracle Linux leads the chaos with a Critical webkit2gtk3 update carrying 323 CVEs, while SUSE announced twenty advisories wrapping roughly 182 vulnerabilities. Chromium recurs across the board with a 32-CVE patch, and several fixes including libvirt, ghostscript and libpcap echo across multiple distros. You should patch first if you're on Oracle's webkit engine or SUSE's pcre2 build, and take SUSE's cumulative kernel live patches as newest-of-family updates.

Linux distros ship another week of security fixes, with webkit carrying 323 CVEs

Ubuntu, Red Hat, SUSE, and a dozen others all shipped patches. The counts are climbing, and this week pulls ahead. Somewhere in the shuffle sits a browser engine with 323 vulnerabilities, a Chromium build with 32, and a SUSE batch that claims 182 individual problems.

Oracle Linux is where you'll find the standouter. Its webkit2gtk3 advisory (ELSA-2026-74084) jumps to 2.54.0 and carries 323 CVEs tagged Critical. That's a browser engine most people never think about unless their box is on fire, and 323 outclasses just about everything else on the board. Fix it before you fix much else.

SUSE went the other way, chasing volume instead of severity. Its October 5th batch of twenty announcements wraps roughly 182 vulnerabilities across openSUSE Tumbleweed, Leap, and SUSE Linux Enterprise. Only one reaches Critical, and it's the usual monthly Chromium fix at 154.0.8037.92.

Keep in mind that a good chunk of those 182 SUSE numbers overlap, so the real distinct problem count sits well under that figure. Still, it's a wall you have to walk through.

The Chrome problem keeps recurring across every distro this week. Fedora 43 shipped three updates in one batch, and the chromium one is the long. Google bundles upstream issues into a handful of advisories, but Fedora spells out each of the 32. Type confusion in V8 leads with five hits, use-after-free bugs fill half a dozen components, and authorization failures round things out across Payments, CORS, WebView and SiteIsolation. On Chrome's upstream build you're already covered. On open-source Chromium, it's time to move.

That same 154.0.8037.92 browser shows up again in SUSE's Critical slot, so you're not imagining it. Chrome collects front-page exploits every month and this month is no exception.

The kernel keeps doing all the work

Kernel updates are the honest reason most of these tallies exist. AlmaLinux rolled out a batch split between versions 10 and 9, and more than three-quarters of its roughly 75 CVEs are kernel fixes. The biggest single advisory, ALSA-2026:71602, alone packs 22 fixes spanning amdgpu out-of-bounds reads, a PPPoE memory-corruption bug, and an nvme-tcp disclosure that would leak host RAM on a read command. Grab that one first.

Several of those dates are stamped 2026, meaning some advisories are riding forward-looking identifiers while the release dates all sit in early October 2026. Not much to do about it beyond apply the patch, but if your pipeline ever chokes on unknown CVE years you now know where the noise comes from.

Ubuntu leans on kernels too. Its Raspberry Pi update (USN-8871-1) plugs an ARM64 flaw where broadcast TLB invalidation could finish before memory writes were globally observed. A local attacker could then write to memory after permissions were pulled back. That's the quiet kind of bug that hands over elevated access without much fanfare.

The Azure kernel update (USN-8851-3) is smaller, three issues in the NFS server, IPv6 and Netfilter. Note the ABI change, though, since any third-party modules you built yourself will need recompiling after you upgrade.

Things past the browser worth chasing

SUSE's batch has a few real standouts beyond Chrome. pcre2 carries the top scores, two 9.2-rated out-of-bounds writes under CVE-2026-89157 and CVE-2026-89158. If your build chain compiles against PCRE2, run this one now. The lone valkey entry, CVE-2026-92925, is a 7.1 out-of-bounds read in the cluster bus parser, which bites if you run a Redis-compatible store in a cluster.

Then there's the kernel live-patch pileup. SLE 15 SP5 alone gets four separate announcements, Live Patches 39, 41, 43 and 44. SP7 gets two, SP6 gets one. They're cumulative, so the newest patch in each family already covers the earlier CVEs. Apply the latest of each family and don't treat them as separate fixes. SUSE does like to slip in an extra fix now and then too, and rpm quietly closed a leaked libelf handle that breaks NFS buildroots along with its security patch.

Red Hat kept everything at Important rather than Critical, 22 advisories across RHEL. A few touch the stuff that actually bites: sudo, bind, kernel, libvirt. Most of the attention lands on RHEL 10, and there's a lone Single Sign-On entry still targeting OpenShift Container Platform 3.10 and 3.11, old enough that you may want to check whether you're actually running something that far behind.

Debian brought the biggest single advisory with perl (DLA-4821-1), 13 CVEs including heap overflows, code execution, and some oddly sneaky problems like silently wrong regular-expression matches. If you parse archives or compile regexes on 32-bit systems, that batch wants your attention. One wrinkle worth flagging: the Archive::Tar fix broke libmodule-cpants-analyse-perl's test suite, so Debian published a follow-up (DLA-4821-2) the very next day.

The rest is smaller housekeeping. Slackware issued a 13-issue CUPS bump (SSA:2026-278-01) for its print server, Rocky Linux shipped two Important errata for version 8 covering pki-core and nodejs:22, and the libvirt, ghostscript JPEG 2000, and libpcap BPF fixes all echo across multiple distros, which is just the sane way to do this.

A Detailed Breakdown of the Updates

AlmaLinux

AlmaLinux rolled out a batch of errata this week split between AlmaLinux 10 and 9, and the kernel is doing most of the work. Six advisories hit version 10, four landed on 9, and between them they carry about 75 CVEs. More than three-quarters of those are kernel fixes, a tally that should tell you exactly where the security work actually landed. Kernel updates have a habit of showing up in just about every round, and this week is no exception.

Those kernel hauls are spread across four separate releases, so you won't get one clean update if you're watching this closely. The biggest, ALSA-2026:71602, alone packs 22 fixes spanning amdgpu out-of-bounds reads, a PPPoE memory-corruption bug, and a memory disclosure in nvme-tcp that would have leaked host RAM on a read command. You probably want to grab that one first.

The rest of the round is quieter but not uninteresting. On AlmaLinux 9, the libvirt update closes a swtpm symlink-following privilege escalation plus a heap overflow in the page-handling RPC, which matters if you run virtualized guests. osbuild-composer on both versions eats a batch of Go dependencies, where the headline issues are an arbitrary-code-execution XSS in the HTML parser and a privilege-escalation bug in Punycode handling. Git-lfs gets three Go-related denial-of-service fixes, and Ruby's single change stops a memory-growth DoS from crafted DNS responses. Ghostscript is the only Moderate severity in the whole round, a JPEG 2000 heap overflow that probably won't wake you up at night unless you render suspicious PDFs for a living.

The CVE dates are worth a glance. Several are stamped 2026, meaning they're riding some unusually forward-looking identifiers, while the advisory release dates all sit in early October 2026. Nothing to act on beyond the usual "apply the update," but if your patching pipeline ever chokes on unknown CVE years, you now know where the noise comes from.

Debian GNU/Linux

Debian's security and LTS teams rolled out a pile of patches, and perl is the one to look at first. The perl advisory (DLA-4821-1) carries 13 CVEs, spanning heap buffer overflows, code execution, and some oddly sneaky problems like silently wrong regular-expression matches. If you parse archives or compile regexes on 32-bit systems, this batch is worth your time. The standout issues are a glob in IO-Compress that runs arbitrary Perl when handed a hostile output string, plus an Archive::Tar symlink escape that lets attacker-chosen targets point outside your extraction directory.

The rest of the batch is smaller. ruby-oauth2 closes a redirect flaw that leaks bearer tokens to whatever host a redirect names. Roundcube is on the receiving end of a long list of browser-land problems: XSS, SSRF, email header injection, and privilege escalation. Sabnzbd's web UI could run arbitrary code or skip authorization entirely. LibreOffice picks up six CVEs for crashing or executing code on malformed documents, the usual "don't open that attachment" story.

There are also two housekeeping items. One is a genuine annoyance: the Archive::Tar fix shipped in the perl update broke the test suite for libmodule-cpants-analyse-perl, so Debian had to publish a follow-up (DLA-4821-2) the very next day. The other is a use-after-free in libpng1.6 that would mostly show up as a crash rather than anything flashier.

All the perl, ruby-oauth2, Roundcube, and libpng fixes land in Debian 12 bookworm, while sabnzbd and LibreOffice shipped for the stable trixie release. Upgrade if you haven't already.

Fedora Linux

Fedora shipped three updates to its Fedora 43 release in a single batch, and two of them are the kind you install without reading the fine print.

The browser is the headline, and it is a long one. The chromium update to 154.0.8037.92 closes 32 distinct flaws, which is a lot even for a point release. Google's own Chromium builds bundle these into a handful of advisories, but Fedora's notification spells out each one. Type confusion in the V8 JavaScript engine leads the way with five separate hits, and use-after-free bugs turn up in half a dozen components, from Bluetooth and Passwords to FullScreen and Views. Uninitialized-memory reads, buffer overflows, a cross-site scripting hole in the WebUI, and a cluster of authorization failures across Payments, CORS, WebView and SiteIsolation round things out. If you're on Chrome's upstream build, these are already covered. If you're actually using the open-source Chromium, it's time to update.

The kernel got 7.2.9 as a stable point release, which pulls in a pile of tree-wide fixes from upstream. Two changes are specific to Fedora though: a revert of the af_alg_restrict sysctl for the 43 and 44 tracks, and a new allowance for unprivileged users to call hmac(sha512). The rest is just 7.2.9 doing its normal job.

Python had its turn as well. Version 3.12.15 packages eight security fixes, including a use-after-free on the server-side SSLContext that the advisory specifically calls out (CVE-2026-19445). The remaining seven are standard patches for the 3.12 line.

Three updates, none a lone reason to panic, but a browser with 32 holes alongside a kernel and a Python interpreter in one shot is about as much housekeeping as you can ask for.

Oracle Linux

Oracle Linux shipped a broad batch of updates across OL8, OL9, and OL10, mixing security advisories with a bug-fix notice. The list runs long, so some of it is unavoidable housekeeping. The kernel appears three times on OL8 for the same 553.168.1 build, which feels like more errata than the job strictly requires.

The entry that actually earns attention is webkit2gtk3 for OL8, tagged Critical with 323 CVEs and a jump to version 2.54.0. That is a browser engine most people never think about, and it carries a far bigger vulnerability count than anything else in the batch. bind for OL10 is next loudest at five CVEs.

Several fixes recur across distros, which is the sane way to do it. The libvirt integer-overflow patch (CVE-2026-18917) and the libpcap BPF change (CVE-2026-0799) both hit OL9 and OL10, as does ghostscript's JPEG 2000 heap overflow (CVE-2026-39919). gvfs takes the same two CVEs on OL9 and OL10 but only one on OL8.

The rest is mostly routine. mailx gets a UTC offset fix for its Date headers, and a pile of kernel entries absorb whatever landed upstream. Nothing spectacular, but that webkit number alone makes this batch worth installing quickly.

Red Hat Enterprise Linux

Red Hat pushed another round of "Important"-rated advisories across RHEL, and if you're responsible for keeping a fleet patched, this is the part you care about. All 22 are tagged Important rather than Critical, which mostly means the flaws here land somewhere in the middle of the severity ladder, worth fixing promptly, but not the "shutdown and reboot at midnight" kind. A handful touch the stuff that actually bites people: sudo, bind, kernel, and libvirt.

What stands out is how many are going to RHEL 10, which tells you where Red Hat's pushing its attention. You'll also spot two separate Single Sign-On entries, one of which is an OpenShift image still supporting Container Platform 3.10 and 3.11, old enough that you may want to check whether you're actually running something that far behind. There's a lone entry for RHEL 7 Extended Lifecycle Support, which is the paid extension track, so don't act surprised if you're not on it.

Rocky Linux

Rocky Linux rolled out two more security errata for version 8, both tagged "Important" rather than the scarier "Critical." You won't need to cancel dinner, but both are worth applying before someone reminds you you didn't.

The first (RLSA-2026:75573) is a pki-core:10.6 update that reaches into the surrounding Java toolchain, touching the tomcatjss, resteasy, ldapjdk, and jss modules along with their versioned siblings. The second (RLSA-2026:75870) bumps nodejs:22 and the packaging and nodemon modules. Each entry links a full CVE list with CVSS base scores, so you can check exactly how bad each hole is before touching a live box.

Slackware Linux

Slackware just issued a security bump for CUPS, the print server that quietly sits on most Linux boxes handling everything from a single PDF to an entire office's paper hunger. This one, SSA:2026-278-01, is a fairly generous haul. Slackware lists 13 separate issues, which is a lot of vulnerabilities to cram into what was, to most users, an unchanged print queue. New builds ship for Slackware 15.0 and -current.

The fixes themselves are a grab bag of scheduler and validation bugs: the scheduler didn't open temporary PPD files exclusively, forgot to strip job-status attributes, and left request languages unvalidated. One UTF-32 converter mistook 32-bit values for 64-bit, held jobs crashed the scheduler, and startup permission checks fell prey to time-of-use attacks. A few of these are the "someone could crash your print server" variety rather than the "your data is gone" variety, though with 13 entries it pays to patch anyway.

SUSE Linux

SUSE shipped a proper wall of security updates on October 5th: twenty announcements across openSUSE Tumbleweed, openSUSE Leap, and SUSE Linux Enterprise, wrapping in roughly 182 individual vulnerabilities. Only one of them earns a critical rating, and that's the standard monthly Chrome fix, so if you're skimming for something to lose sleep over, that's it. The rest is either local-only, routine maintenance, or a browser that picks up front-page exploits every month and this month is no exception.

The chromium update is the sole critical entry, landing on openSUSE Backports SLE-15-SP7 at version 154.0.8037.92. Thirty-two CVEs is normal for a browser getting its monthly treatment, and this batch reads like the usual roster: type confusions and use-after-frees in V8, GPU, Blink, and WebGPU, plus a scatter of cross-site scripting and authorization holes. You patch it because leaving Chrome unpatched in 2026 is its own form of bravery.

Three things actually stand out past the browser. First, pcre2 carries the highest scores in the set, with two 9.2-rated vulnerabilities (CVE-2026-89157 and CVE-2026-89158, both out-of-bounds writes). If your build chain compiles against PCRE2, run this one. Second, SUSE handed out a pile of overlapping kernel live patches. SLE 15 SP5 alone gets four separate announcements (Live Patch 39, 41, 43, and 44), SP7 gets two (7 and 15), and SP6 gets one (29). They're cumulative, so the newest patch in each series already covers the earlier CVEs. Apply the latest of each family rather than treating them as distinct fixes. Third, the lone valkey entry is worth a look: CVE-2026-92925 is a 7.1-rated out-of-bounds read in the cluster bus packet parser, which bites if you run a Redis-compatible store in a cluster.

The remainder is mostly moderate or the "important" tier that just doesn't reach critical. binutils tops the line-item count with 16 CVEs, but nearly all sit at 5.5 or below and require local access, so they only matter if you trust unprivileged code on a machine shipping them. Two do climb to 7.8 (CVE-2026-18220 and CVE-2026-6846), though they stay AV:L. Tumbleweed's moderate group includes squid's CVE-2026-50012 at 8.1, the one to flag if you run a proxy. The single-hitters are scattered but genuine: a use-after-free in wpa_supplicant (CVE-2026-78807, 8.4), a heap buffer overflow in libX11's keyboard map handler (CVE-2026-88806, 8.9), and an out-of-bounds read in the SSSD PAM responder. rpm also tacks a non-security bugfix onto its security patch, closing a leaked libelf handle that breaks NFS buildroots, since SUSE apparently likes to slip in an extra fix now and then. Keep in mind a good chunk of those 182 numbers overlap, so the actual count of distinct problems sits well under that.

Ubuntu Linux

Ubuntu shipped another round of security fixes on October 5th, and this week's batch leans on kernel work. There are seven updates total, spanning Microsoft Azure's custom kernel down to LibreOffice throwing a fit over a bad PDF.

The Raspberry Pi kernel (USN-8871-1) carries the most interesting fix. It plugs an ARM64 flaw where broadcast TLB invalidation could finish before memory writes were globally observed, letting a local attacker write to memory after permissions had been pulled back. That is the sort of bug that quietly hands over elevated access, and it ships alongside nineteen more kernel fixes across InfiniBand, NFS, IPv6, and friends.

The Azure kernel (USN-8851-3) is smaller, three issues in the NFS server, IPv6, and Netfilter. Take note of the ABI change, though, since any third-party kernel modules you built yourself will need recompiling after you upgrade.

LibreOffice (USN-8868-1) gets a fresh upstream release to close eight gaps. Dodgy WMF, PDF, and PICT imports, plus CFF and Graphite fonts, can crash the app or run arbitrary code, and a couple of URL-handling and validation shortfalls leak data. On 26.04, 24.04, or 22.04? Grab it.

The remaining fixes live mostly in backend territory. EDK II (USN-8865-1) patches four OpenSSL-in-UEFI issues affecting everything from 16.04 to 26.04, including a forged-message acceptance hole on the newer releases. Ceph's object gateway (USN-8867-1) let presigned-URL holders slip unsigned headers through to grab more privileges than the signer intended. OpenStack's Aodh and Watcher (USN-8870-1) let you read alarm metadata or fire action plans without proper checks, so restart both after updating. The libxmltok/Expat update (USN-8872-1) could crash on a crafted XML file, but it's largely Ubuntu Pro and ESM ground.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all