Major Linux distributions including AlmaLinux, Debian, Fedora, RHEL, Rocky, SUSE, and Ubuntu all shipped critical security updates today, with the Python ecosystem, Node.js, and GStreamer taking the heaviest hits for remotely exploitable flaws. The tarfile extraction filter bypass and a cluster of heap overflows in GStreamer plugins are leading the charge, while kernel patches across the board address over 150 CVEs ranging from privilege escalation to denial of service vectors. Ubuntu cloud and Raspberry Pi users need to schedule maintenance windows carefully due to kernel ABI bumps requiring out-of-tree driver rebuilds, and Red Hat customers must juggle separate image pulls for OpenShift 4.20 through 4.22. While most updates apply cleanly through standard package managers, the sheer volume of Python and Node.js fixes makes a routine maintenance window the safest move before the weekend.

Today's Linux Security Roundup: tarfile Bypasses, GStreamer RCEs, and Kernels Under Siege

If your patching scripts haven't run yet, you might want to let them do their thing before you touch a keyboard. Red Hat, Fedora, Rocky, AlmaLinux, Debian, SUSE, and Ubuntu all shipped security errata today, and the common thread is pretty clear: Python, Node.js, and GStreamer are having a very bad quarter.

The tarfile extraction filter bypass showing up across Python 3.12, 3.14, and AlmaLinux's patched pyasn1 packages is the kind of flaw that lets archives quietly escape their target directory. You can build malicious tarballs that slip past extraction filters and land files wherever the process has write access. Pair that with the cluster of heap overflows in GStreamer audio and video plugins, and you have a recipe for remote code execution that doesn't require user interaction in many setups. GStreamer1-plugins-good alone carries four CVEs for this cycle.

The Linux kernel continues to absorb the heaviest blast radius. Debian's Trixie stable kernel pulled over 150 CVEs for privilege escalation and denial of service vectors. AlmaLinux 10 hit with roughly two dozen, while Ubuntu's cloud, Azure, AWS, and Raspberry Pi kernels all bumped their ABI versions, meaning any out-of-tree drivers you compiled yourself will need rebuilding before a restart. SUSE handled the kernel load differently, shipping four staggered live patches for SLE 15 SP6 alone. You can apply those without a reboot, though the overlapping networking and scheduling fixes show up across every service pack.

The Userland Stack Takes Another Beating

Node.js 22 and 24 are landing security fixes across Rocky, AlmaLinux, and Fedora. The fixes cover brace-expansion denial of service flaws and SSRF weaknesses in IP address parsing. Chromium is pulling another two-dozen vulnerability patches this cycle, with V8 race conditions and an import flow privilege escalation standing out as the actual threats worth tracking.

OpenSSL keeps churning out monthly maintenance. Debian stable and Ubuntu LTS both landed ten fixes each, targeting TLS/SSL toolkit denial of service vectors. Most of the damage here is flares in QUIC and CMP handling, but Ubuntu's batch also includes a CMS key unwrapping flaw that actually allows arbitrary code execution. Perl is getting hit hard across Ubuntu's LTS releases, closing heap reads in the Socket and pack modules alongside a regex bypass that could slip past existing security rules.

Red Hat's errata list reads like a catalog of enterprise housekeeping. sqlite, sg3_utils, ignition, and nginx are patched across RHEL 7 through 10, with separate advisories for the AMCU and EUS lifecycle streams. OpenShift teams will need to pull updates for 4.20, 4.21, and 4.22 plus a MicroShift drop. It's a lot of image pulling, but that's the baseline for maintaining a hybrid container platform.

Debian and Freexian kept the older releases alive with patches for OpenJDK 8 and 11, libvncserver, and FreeCAD. The FreeCAD update closes six vulnerabilities tied to malicious FCStd templates, which is oddly specific but exactly the kind of edge case that turns a seemingly harmless CAD file into an arbitrary code execution vector. We've been watching GStreamer patch cadence since the mid-2010s, when the audio stack first started absorbing heap overflows in basic container format parsers. The rhythm hasn't really changed. Developers keep finding the same buffer boundary mistakes, and distros keep shipping the same weekly hotfixes.

A Detailed Overview

AlmaLinux

AlmaLinux pushed out another batch of errata and the security patch list is long enough to make any sysadmin verify their patching scripts before touching the keyboard. Python ecosystems take up the bulk of the important-severity queue. pyasn1, urwid, and both Python 3.12 and 3.14 are all landing fixes for DoS flaws and a tarfile extraction bypass that lets archives escape their target directory. Node.js 24 and GStreamer round out the serious fixes, with SSRF weaknesses in IP address parsing and a cluster of heap overflows in audio/video plugins that hand attackers remote code execution. The Linux kernel on AlmaLinux 10 is getting the heaviest treatment, with roughly two dozen CVEs patched alongside a few lingering CIFS and SCSI bugs. If you run nginx on AlmaLinux 8, that 1.24 branch picked up the same heap read vulnerabilities as the newer nginx release on AlmaLinux 10. QEMU/KVM and NetworkManager close out the moderate-severity queue with virtualization sandbox gaps and dhclient privilege escalation paths. You will want to apply these across the board before the weekend.

Debian GNU/Linux

Debian and Freexian rolled out another batch of security patches. If you are still running older Debian releases, your package manager has work to do.

The Linux kernel takes the heaviest blow with over 150 CVEs addressing privilege escalation, denial-of-service vectors, and information leaks across several subsystems. OpenSSL rounds out the stable distribution side with ten fixes targeting the TLS toolkit, while FreeCAD closes six vulnerabilities tied to malicious FCStd templates that could run arbitrary code or expose local files. On the extended support front, libvncserver picks up four patches for heap over-reads, null pointer crashes in the HTTP proxy, and framebuffer writeouts. OpenJDK 8 and 11 both address three shared flaws that could otherwise trigger crashes or leak sensitive data. You will want to apply these across the board, particularly if you are still managing systems on Bullseye or Buster.

Fedora Linux

Fedora is rolling out another batch of security patches for F43 and F44, and if you run Python, you should update today. The interpreter gets fixes across every supported branch, covering a tarfile escape, denial-of-service traps in the XML and HTML parsers, plus several use-after-free and command injection flaws. Chromium lands roughly two dozen vulnerability fixes across two releases this cycle. The list is long, but the V8 race conditions and the privilege escalation in the import flow are the ones that actually matter. Outside the Python and Chromium camps, nnn, perl-DBI, apr-util, and sympa also get security bumps that are worth installing. You can pull everything through dnf upgrade in one go.

Red Hat Enterprise Linux

Red Hat rolled out another round of security advisories, and this batch touches everything from legacy RHEL 7 extended lifecycle streams to fresh RHEL 10 installations. The ratings skew toward Important, with only a handful of packages like httpd, attr, pam, mod_http2, and the RHEL 9.4 SAP kernel landing at Moderate or Low. You will notice the same components patched multiple times across different release tracks, which is standard Red Hat housekeeping for sqlite, sg3_utils, ignition, and the OpenShift Container Platform. That said, three separate OpenShift releases (4.20, 4.21, and 4.22) plus a MicroShift drop means platform teams will have some image pulling to handle. Kernel and container runtimes continue to ship the usual combination of security fixes, bug repairs, and minor enhancements, so you will probably want to verify boot sequences and container registries before rolling these out in production.

AMCU stands for Advanced Mission Critical Update Support. EUS stands for Extended Update Support. You can pull the full CVE references and CVSS scores from each errata link in the source list.

Rocky Linux

Rocky Linux has released a fresh round of security errata spanning versions 8, 9, and 10. Node.js is taking a heavy hit this cycle, with security patches landing for both Node.js 22 and 24 across all three supported releases. Python isn't far behind, with updates for Python 3.12 and 3.14 targeting versions 9 and 10. GStreamer, Nginx, and SQLite are also getting fixed across the stack, and Go developers should check the advisories for golang and the go-toolset on the older releases.

Most entries are marked Important, but the Grafana update on Rocky Linux 9 is rated Moderate. That might actually be a welcome change, since it bundles security fixes with bug fixes and enhancements rather than just closing holes. You can check the CVSS scores in the linked errata if you want to judge the severity yourself, but given the volume of packages affected, a routine update window is probably the safest move.

SUSE Linux

SUSE pushed its latest security batch this week, and the kernel live patches take up most of the space. If you run SUSE Linux Enterprise 15 SP4 through 15 SP7, you should run zypper patch before the weekend. The kernel updates cover the standard mix of network stack, crypto, and memory management flaws, which is about as thrilling as a sysadmin gets on a random Tuesday but still needs doing. SLE 15 SP6 gets the longest treatment, shipping four staggered live patches (25 through 28) that chip away at 12 to 17 vulnerabilities each. SP4 and SP5 each receive a single update covering 16 to 18 CVEs. The patch inventory overlaps heavily, with the same core set of networking and scheduling bugs appearing across every service pack variant.

Container tooling also gets a quiet upgrade. buildah, rootlesskit, and the distribution registry are all rebuilt against a fresh Go security release, so you do not need to hunt down specific container CVEs. Two smaller announcements round out the list: git-lfs fixes a file path collision bug, and librest patches a weak random number generator in its OAuth implementation. Tumbleweed users just need to pull the hauler update to clear two minor CVEs.

Ubuntu Linux

Ubuntu shipped another security round for late August, and the kernel patches are doing the heavy lifting. If you run cloud instances or Raspberry Pi hardware, plan a maintenance window. Every kernel notice in this batch bumps the ABI version, which means any out-of-tree modules you compiled yourself will need rebuilding before you hit restart. The standard package manager swaps the metapackages automatically, but the reboots are non-negotiable.

The userland fixes are where you should actually pay attention. Perl addresses four issues across six LTS releases, closing heap reads in the Socket and pack modules alongside a regex bypass that could slip past existing security rules. OpenSSL covers ten CVEs. Most of the damage is denial-of-service flares in QUIC and CMP handling, but the CMS key unwrapping flaw that allows arbitrary code execution is the one worth taking seriously. Vim closes out the userland with a crafted tags file vulnerability that lets an attacker run programs under your login. curl and FFmpeg round out the batch with connection reuse and media parsing risks. A standard system upgrade pulls everything down cleanly, though the kernel ABI bumps are the only reason you might want to handle this manually.

Full package version lists and reference links are available on the Ubuntu Security Notices page. Run unattended-upgrades or apt upgrade, then schedule those reboots.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y