A wave of security updates swept Linux distros, with Ubuntu, Red Hat, Oracle, SUSE, Qubes, and several others pushing patches. The most alarming is Qubes QSB-121, which fixes a Xen flaw (XSA-523) that lets a malicious qube read and write arbitrary memory in other qubes and dom0. Images and HTTP libraries recur throughout the batch, featuring critical Pillow fixes across Oracle and SUSE alongside 31 new CVEs for curl, while kernels dominate the Ubuntu, Oracle, and Red Hat releases. Patch Pillow, update curl, don't skip the kernel bumps, and prioritize the Qubes fix since most of this reaches you through your distro's normal patching.

Qubes OS warns of isolation-breaking Xen flaw as distros push November security updates

A wave of security advisories swept Linux around November 3. From a Qubes flaw that breaks isolation to a Pillow hole shared across Oracle and SUSE, here's what you actually need to patch.

Qubes OS dropped QSB-121 today, and it targets a Xen flaw called XSA-523. The short version is that a malicious qube can read and write arbitrary memory in other qubes, dom0 included. That's a problem worth saying plainly: everything a Qubes machine sells you is isolation, and this is exactly the thing it can no longer do.

The bug lives in Xen's grant copy optimization. When a batch of Grant Copy operations lands on adjacent address ranges, Xen caches data it has already validated to save time. Its re-validation logic was off, and two problems come out of it. Frame numbers and grant references can get swapped, which is CVE-2026-102703. Frame-number copying that should only touch the caller's own memory slips past a misplaced check, which is CVE-2026-102704. Every supported Qubes release is affected, so there is no way to sit this one out.

Community testing gates the fix for another couple of weeks, so Xen 4.19.6-3 in dom0 only reaches the stable repo later. You can pull it early from security-testing if you are impatient. Either way you will have to restart dom0, and if you run Anti Evil Maid you need to reseal your passphrase because PCR18 and PCR19 change with the new binaries. That is a footgun worth knowing before you are halfway through the upgrade.

Images and HTTP libraries are the common thread

Pillow, the image library that quietly runs on just about everything, gets a Critical update from both SUSE and Oracle. SUSE's patch, SUSE-SU-2026:5038-1, packs 29 fixes that range from decompression bombs to remote code execution. Oracle marks its version Critical on OL8 as well, with a Ghostscript argument-injection path that can turn into RCE. Oracle says if you process TIFF or FPX images this one wants a reboot soon.

It's the usual image-processing menu: heap overflows, double frees, and, in Pillow's case, taking Ghostscript arguments and handing them straight to a code execution path. You might want to reconsider how much you trust a PDF.

SUSE also hands curl 31 CVEs and bumps it to 8.22.0. Cookie handling, redirects, credential exfiltration. It's curl. You use curl. There is not much more to say.

Kernels pile up

Ubuntu shipped 37 security notices on November 3, and the kernel dominates. The kernel half alone spans ten notices, reaching back to the 3.13 kernel still riding with 14.04. The newest 7.0 kernel gets its cloud variants through USN-8959-1, and a 5.15 sweep touches everything from Azure and NVIDIA down to Intel IoT. The quirk is that most kernel notices never name their flaws. They lean on the classic "several security issues were discovered" and hand you a subsystem list long enough to test your attention span.

A couple do spell things out though. The AX.25 amateur-radio race condition, CVE-2022-1205, found by Duoming Zhou, recycles across three separate kernel bumps. It's 2026, and a pair of two-decade-old bugs still show up on the manifest.

Oracle's round is wide, reaching OL7 through OL10 with 31 advisories, two parked at Critical. The kernel trees are where the CVE counts get alarming. The OL9 UEK 6.12 kernel carries 307 CVEs, which mostly reflects the standard upstream batch you get on any kernel bump rather than 307 separate holes in Oracle's own tree. The OL8 legacy 4.18 kernel still earns its Critical for essentially one fix, CVE-2026-98432. Keep in mind that the same pair of CVEs also turns up in libXi across Oracle's releases: CVE-2026-109089 and CVE-2026-109090, both RCE via a heap overflow and an oversized reply.

Red Hat put out 34 advisories, and its Criticals cluster on kernel, kernel-rt, and fence-agents. The standout is the latter, which alone carries five Critical advisories across a spread of EUS and SAP channels, more than you'd expect from a cluster fencing tool. The batch skews Important overall, with 18 of 34. OpenShift users should be hunting for 4.21.41. Several advisories also target specific maintenance channels, so the right package depends on which support track your box runs on, and it's easy to grab the wrong RPM in a mixed fleet.

The rest of the day's news is smaller but still worth a glance.

AlmaLinux pushed 10 advisories on November 3, and Firefox grabs most of the room. It took 41 separate CVEs into a single ESR update, half of them use-after-free bugs. libXi ships two arbitrary code execution holes, and FreeRDP has three DoS bugs, one of which trips during MP3 audio decoding, a peculiarly specific way to get knocked offline.

SUSE's 29 advisories also include apache2 with 18 fixes and sssd absorbing credential-exfiltration and authentication-bypass work. Several kernel advisories are live patches, so you can apply them without rebooting, which is genuinely a relief.

Rocky bundled 20 advisories under the RLSA-2026 series, mostly Important, with only pipewire and podman at Moderate for Linux 10. Kernel updates land on 9 and 10, and bind shows up three times, so DNS admins should pay attention.

Debian went quiet on volume but still moved. It pushed a Squid patch, DSA-6606-1, with three CVEs: request smuggling, buffer overflows, and FTP command injection. The fix landed in 6.13-2+deb13u4 for trixie. The advisory groups all three under general attack classes rather than mapping each ID to a specific flaw, so the security tracker page is where you dig if you want the granular breakdown.

Fedora shipped 33 package updates across 43, 44, and 45, and Chromium is the obvious headline. All three releases took the exact same 21-CVE roundup, meaning the upstream update landed everywhere at once. The rustls family also got rebuilt around the eMudhra intermediate CA situation, so bumping ca-certificates is worth a look. The kernel update on 43 is a bit theatrical, since much of it just reverts an af_alg_restrict sysctl change. That's the kernel admitting upstream shipped something that didn't work out.

Slackware bumped expat to 2.10.0 with four CVEs, out for both 15.0 and -current. It's a tidy update for the format, covering a DoS via XML_ParserReset, billion laughs detection, subparser segfaults, and a signed integer overflow in storeAtts. One detail is worth reading twice: a layer of compression around XML can shrink the minimum payload an attacker needs, which matters if you ever parse XML straight out of a gzip stream.

If you're keeping score, the common threads here are images, HTTP libraries, and kernels. Patch Pillow, update curl, and don't skip the kernel bumps even when the CVE count looks inflated. The Qubes XSA-523 fix deserves top priority if you run the distro. Run your updates before the next patch window closes.

A Breakdown of the Updates

AlmaLinux

AlmaLinux pushed out 10 security advisories on November 3rd across AlmaLinux 8 and 9, and the spread of severities tells a story. Most land at "Important," two sit at "Moderate," and Redis gets downgraded all the way to "Low." That last one isn't a knock on Redis, just a case where the two fixes read more like reliability nits than anything that would wake you up at 3 a.m.

Firefox is the one that grabs most of the room. It took 41 separate CVEs into a single update for the ESR branch, and half of them are use-after-free bugs. Mix in a handful of sandbox escapes, privilege escalations, and a couple of info-disclosure issues, and you have the kind of update that makes a patch cycle feel productive. If this browser runs on anything you touch, this probably climbs to the top of your list.

The rest are less flashy but still worth a look. libXi has two arbitrary code execution holes in the X11 input handling, which bites anyone near a graphical desktop, and FreeRDP ships three denial-of-service bugs, including one that trips during MP3 audio decoding (a peculiarly specific way to get knocked offline). Two separate BIND advisories hit the DNS side, one for the main package and one for the 9.16 stream, both carrying denial-of-service flaws and one with arbitrary code execution via a GSS-TSIG replay. Qt picks up two XML-parsing DoS fixes, and Perl plus perl-YAML take hits for arbitrary code execution and a hostname-encoding bypass that hides behind missing Unicode normalization. The kernel gets two ethtool changes that feel more like stability guards than glaring exploits.

Debian GNU/Linux

Debian just pushed a security patch for Squid, and it's the kind of you-don't-care-until-you-should update that tends to matter. Three separate CVEs made the list, each opening a different door: request smuggling, buffer overflows, and FTP command injection. Your average caching proxy isn't exactly begging to be weaponized, but any of those three is enough to make a sysadmin look up from their coffee.

The fix landed in version 6.13-2+deb13u4 for the stable (trixie) release. Debian recommends upgrading, which is the whole point of security advisories. If you're running Squid on trixie and haven't run an update recently, this is the nudge.

One thing worth flagging: the advisory groups all three CVEs under general attack classes rather than mapping each ID to a specific flaw. If you want the granular breakdown of which CVE does what, the security tracker page is the place to dig. Otherwise, upgrade and move on.

Fedora Linux

Fedora shipped a batch of security updates across Fedora 43, 44, and 45 between late October and early November 2026. Counting the advisories, that's 33 packages affected. Nothing dramatic, but a few patterns are worth your attention.

Chromium is the obvious headline. All three releases got the exact same 21-CVE security roundup, which means the same upstream update landed everywhere at once. If you run Chromium on any of these, update it.

Then there's the rustls family. A string of packages (rust-qemu-rdp, rust-redlib, rust-app-store-connect, and selenium-manager on both 44 and 45) got rebuilt against fresh rustls and rustls-webpki builds. The shared motive is the eMudhra intermediate CA situation plus a pile of RUSTSEC identifiers, so if you haven't already, bumping ca-certificates is worth a look.

Python moved on its own axis: 3.14 picked up a new release (3.14.10) with its own set of CVEs, while 3.9 kept receiving security patches from the back end. The kernel update on 43 is a little theatrical on its own terms, since a big chunk of it is just reverting an af_alg_restrict sysctl change. That's the kernel saying upstream shipped something that didn't work out.

The smaller items are mostly CVE backports: mingw-qt6-qt5compat, mingw-harfbuzz, and mingw-qt5-qtwebkit all grabbed out-of-bounds read and write fixes, and Python's mistune markdown library took a multi-CVE hit.

Oracle Linux

Oracle Linux shipped a wide security errata round that reaches OL10, OL9, OL8, and OL7. Thirty-one advisories in all, most parked at Important severity, with two Criticals: the OL8 4.18 kernel and python-pillow.

The kernel trees are where the CVE counts get alarming. The OL9 UEK 6.12 kernel (ELSA-2026-500572) carries 307 CVEs. That number mostly reflects the standard upstream batch you get on every kernel bump, not 307 separate holes in Oracle's own tree. The OL9 and OL8 UEK 5.15 kernels each land 289 CVEs for the same reason. The OL10 upstream kernel is more sedate at 16 CVEs, and the OL8 legacy kernel (4.18.0-553.182.1) gets its Critical rating for essentially one fix, CVE-2026-98432.

Java inflates the tally too. OL10's Java 21 patch (ELSA-2026-90504) pulls in 38 CVEs, and OL9's Java 17 (ELSA-2026-90500) takes 36. One update each covers both.

A couple of specifics are worth your attention. The OL10 podman update (ELSA-2026-93464) earns its Moderate rating mostly by dropping a nmap-ncat dependency and skipping one test. The CVE-2025-11395 fix rides along from upstream too, but you could call this a modest patch honestly. python-pillow is the opposite case on OL8: Critical, with a Ghostscript argument-injection path that can become remote code execution, plus two heap overflows. If you process TIFF or FPX images, this one wants a reboot soon.

libXi is the wildcard. CVE-2026-109089 and CVE-2026-109090 both enable arbitrary code execution (a heap overflow via DEVICE_RESOLUTION and an oversized DEVICE_ENABLE reply), and the same pair shows up on OL10, OL9, and OL8. Thunderbird also takes a beating on OL9, with the 153.5.0 ESR update folding in 62 CVEs.

The rest is the normal sprawl. .NET 8, 9, and 10 appear across OL8 and OL9, with CVE-2026-114148 recurring throughout. glibc on OL9 gains six CVEs, grafana picks up several (incl. CVE-2026-111943 and CVE-2026-97031), tomcat stacks a bag of security-constraint bypasses, and freerdp rounds out OL9. wireshark closes a SPDY heap overflow on OL8, ghostscript re-fixes a -dSAFER bypass, and the two Python advisories (python-jwt and python-pyasn1) handle their respective flaws. gcc on OL8 patches libstdc++ overflow bugs, while the pki-deps module stream rebuild on OL8 drags jackson-databind through a pile of Java library rebuilds.

Qubes OS

Qubes OS published QSB-121 today, landing on a Xen flaw (XSA-523) that lets a malicious qube read and write arbitrary memory in other qubes, dom0 included. For a system whose entire selling point is isolation, that's roughly the worst outcome you could design for.

The trouble starts with Xen's grant copy optimization. When a batch of Grant Copy operations hits adjacent address ranges, Xen caches already-validated data to save time, but its re-validation logic was off. Two bugs come out of it: frame numbers and grant references can get swapped (CVE-2026-102703), and frame-number copying that should only be allowed on the caller's own memory slips past a misplaced check (CVE-2026-102704).

Every supported Qubes OS release and configuration is affected, so there's not much room for pretending this will pass you by.

Patching is mostly routine but carries two footguns. The fix is Xen 4.19.6-3 in dom0 for Qubes 4.3, and it only lands in the stable repo over the next couple of weeks after community testing, so the impatient can pull it early from security-testing. Either route, you have to restart dom0 for it to take hold, and if you run Anti Evil Maid you'll need to reseal your secret passphrase because PCR18+19 change with the new Xen binaries.

Red Hat Enterprise Linux

Red Hat put out a fresh batch of security errata, and the kernel plus fence-agents are pulling most of the Critical marks. If you maintain RHEL hosts, this is the list to action before your next patch window closes.

The batch adds up to 34 advisories. Severity-wise it skews Important (18 of them), with 11 Critical and 5 Moderate. The Criticals concentrate on a small set of packages: kernel, kernel-rt, and fence-agents. That last one stands out, since fence-agents alone accounts for five Critical advisories across a spread of EUS and SAP channels, more than you'd expect from a cluster fencing tool.

Two things worth a look. The pipewire updates are all Moderate, so no rush there. The two standalone RHEL AI runtime fixes are narrower still, each patching a single component (thrift and ffmpeg) with their CVEs spelled out up front. OpenShift users should be hunting for 4.21.41.

The trickier part is that several advisories target specific maintenance channels, so the right package depends on which support track your box is actually on. Easy to grab the wrong RPM if you're running a mixed fleet.

Rocky Linux

Rocky Linux just pushed a batch of security errata, and if you're running the current releases, it's worth a look before you forget about it. Twenty advisories are bundled under the RLSA-2026 series, with the bulk landing on Rocky Linux 8 and 9, and a smaller set already targeting Rocky Linux 10.

Nearly all of them carry an "Important" severity rating, which is Rocky Linux's second-highest tier. Only two slips down to "Moderate": pipewire and podman, both for Linux 10. The rest of the batch is a grab-bag of things you'd probably rather not leave unpatched. You've got kernel updates on both Linux 9 and 10, though those are the ones that also bundle bug fixes and enhancements, so there's a bit more substance in them than a bare security bump. DNS admins should pay attention to bind, which shows up three times across the releases, and the web stack isn't neglected either, with tomcat and wireshark on the list. Browser and remote-desktop folks get thunderbird, freerdp, and libXi coverage.

Nothing here is a doomsday CVE. These are the routine-but-necessary updates that keep the lights on. Run them.

Slackware Linux

Slackware has bumped expat to 2.10.0, and this one actually fixes several things at once, which is more than these XML-parsing updates usually bother to do. It's out for both Slackware 15.0 and -current, in the usual i586 and x86_64 flavors.

The headline fix is a denial-of-service bug that trips up when XML_ParserReset gets used, and there's also work to stop segfaults that used to happen on certain initial subparser parse calls. More interesting is the attention to billion laughs attacks—the kind of XML bomb that melts a parser's memory with nested entity expansion. The new build detects them faster, though the Slackware notes include a warning worth reading twice: a layer of compression around XML can substantially shrink the minimum payload an attacker needs. That's a useful detail if you ever parse XML straight out of a gzip stream. There's also a fix for signed integer overflow in storeAtts, which guards two variables called attIndex and nPrefixes.

Four CVEs are attached to this release. If you run expat on a Slackware box, this is a quick upgradepkg as root and you're done.

SUSE Linux

If you manage any SUSE Linux Enterprise box, your patch window just got longer. SUSE shipped a fresh batch of security announcements between November 2 and 3, and with 29 separate advisories in a single feed, keeping up means actually opening YaST. The standout is a critical update for python-Pillow, the image library quietly running just about everywhere, fixing 29 flaws that range from decompression bombs to remote code execution. A similar story plays out with curl, which takes 31 CVEs and jumps to 8.22.0.

Pillow's problems are the usual image-processing menu of horrors: heap overflows, double frees, and a particularly fun one where it takes Ghostscript arguments and hands them straight to a remote code execution path. You might want to reconsider how much you trust a PDF. apache2 gets hit twice, sssd absorbs a round of credential-exfiltration and authentication-bypass fixes, and gvfs rounds out the identity-adjacent trouble with a local privilege-escalation hole in gvfs-admin.

Not everything warrants a midnight pager. Several of the kernel advisories are live patches, so you can apply them without rebooting. A few items are pure housekeeping, each fixing one moderate issue on Tumbleweed's GA media, and SUSE split a couple of fixes (the libsoup request-smuggling one, for instance) across separate announcements per service pack. You can eyeball the whole batch below.

Ubuntu Linux

Ubuntu shipped 37 security notices on November 3, 2026, and the Linux kernel dominates the pile, but a grab-bag of older userland apps rounds it out, several of them only reachable behind a paid Ubuntu Pro subscription. Running apt upgrade quietly covers most of it.

The kernel section alone spans ten notices. The newest 7.0 kernel (Ubuntu 26.04 and 24.04) gets its cloud variants through USN-8959-1: AWS, GCP, IBM, Oracle, plus the HWE enablement stack. The OEM build (USN-8960-1) rides along for 26.04. A 5.15-kernel sweep for 22.04 and 20.04 (USN-8961-1) touches an enormous number of variants, from Azure and NVIDIA down to Intel IoT and realtime. NVIDIA Tegra (USN-8963-1), Azure's encrypted CVM kernels (USN-8962-1), the BlueField DPU (USN-8965-1), and older 5.4 and 4.4 kernels complete the kernel half, reaching back to the 3.13 kernel that still ships with 14.04.

The quirk here is that most kernel notices don't name their flaws. They lean on "several security issues were discovered" and hand you a subsystem list long enough to test your attention span. A few do spell things out. The AX.25 amateur-radio race condition (CVE-2022-1205, found by Duoming Zhou) recycles across three separate kernel bumps, as do the 2021 Xen network-backend memory issue (CVE-2021-28714) and the Bluetooth use-after-free (CVE-2021-3640). It's 2026 and these two-decade-old bugs still turn up on the manifest.

The named userland flaws carry the real detail. Bind (USN-8969-1) comes with 18 CVEs, most hitting only the 26.10 build, spanning DNSSEC mishandling, DNS-over-HTTPS, cache poisoning, and a GSS-TSIG flaw that could let someone run code. Rack (USN-8989-1) lists 13, from regex bypasses to full filesystem path disclosure. libsoup (USN-8975-1) tallies 10, PCRE2 (USN-8974-1) has 8, and libvips (USN-8994-1) brings 9, several of them integer overflows that could turn into code execution. GVfs (USN-8970-1) stops unvalidated SFTP, AFP, and MTP responses. GNOME Shell (USN-8971-1) gets a crash and info-leak fix for unvalidated icon dimensions.

The tail of the list is a reminder about what "security update" actually means on a long-outdated release. Ubuntu 16.04 and 14.04 packages, jabberd2, Sprockets, Swift Mailer, feh, Enlightenment, Apt-Cacher, Deluge, CakePHP, libuser, BitlBee, all sit behind "Available with Ubuntu Pro." You can patch an ancient box, but Canonical wants a subscription for the privilege.

Run the kernel updates first, since they force a reboot. The 7.0 and 5.15 bumps carry an ABI change, so any third-party kernel modules like NVIDIA drivers, VirtualBox, or dm-crypt need rebuilding afterward. Everything else is a plain package upgrade, though GVfs and GNOME Shell want a session restart rather than a full machine reboot.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all