Red Hat shipped 42 security errata across RHEL in a single round, nearly all graded Important, while Ubuntu's Raspberry Pi kernel fix alone tracked more than 200 vulnerabilities. The batch spans the major distros, with Oracle Linux kernels resolving up to 31 CVEs each, OpenSSH leading AlmaLinux's updates, and Fedora flagging a cross-site scripting hole in perl-HTML-FormHandler. A few issues stand out for urgency, especially strongSwan's authentication bypass in Ubuntu and a leaked file descriptor in Slackware's nsenter tool. If any of these packages run on hardware you manage, apply the updates, reboot where required, and check Extended Update Support channels before assuming you're already covered.

Today's Linux security roundup: RHEL ships 42 errata, Ubuntu's Raspberry Pi kernel fix tracks 200+ CVEs

A sweeping batch of patching landed across RHEL, Oracle, Ubuntu, Fedora, AlmaLinux, and Slackware. Red Hat moved 42 security errata in one round. Ubuntu's Raspberry Pi kernel update alone tracks more than 200 vulnerabilities. If you run the major enterprise or community distros, there is at least one thing to install today.

Red Hat's batch is the one that makes sysadmins reach for the coffee. All 42 errata, nearly every one graded Important by Red Hat, which reserves that label for problems worth acting on fast. Only three landed at Moderate. One at Low. So this reads as routine patching rather than a fire drill.

The sheer number of entries is mostly an artifact of how Red Hat slices things. Each errata gets carved up by RHEL version and support channel, so a single package can legitimately show up several times. mod_auth_openidc takes the crown with seven separate advisories, mostly aimed at the SAP and long-life tracks. Two Quarkus updates (3.27.5.SP2 and 3.33.3.SP2) are worth a glance because they bundle a fresh release with the fix instead of dropping a bare patch on an old one.

Ubuntu's round is bigger on paper. Twenty-two notices dropped in a single day, covering XML libraries, Java runtimes, media frameworks, and a pile of kernels. The kernels are where the numbers turn ugly. Five notices patched the kernel across cloud and hardware variants, and two of them carry an uncomfortably long CVE list.

The Raspberry Pi update (USN-8668-2) alone tracks well past 200 vulnerabilities spanning 2022 to 2026. That list includes AMD speculative-execution and cache-isolation flaws. Those are essentially chip design quirks, and no amount of apt update is going to make them vanish, though the kernel bits do get closed off. Same story for the IBM notice.

Plan a reboot for either one. Expect the usual ABI-change warning about recompiling third-party modules too.

The one worth taking most seriously is strongSwan. CVE-2026-78134 lets an authenticated user bypass authentication entirely, which is meaningfully worse than the usual denial-of-service crash. It carries 11 CVEs in total.

Java got its regular quarterly treatment. OpenJDK 8, 11, 17, 21, and 25 all picked up the same trio of authentication-handling fixes. None should keep you up at night, but they hit a lot of supported releases at once, so one pass covers it. And if you are still on 14.04, 16.04, or 18.04, most of this only comes through Ubuntu Pro. A decent reminder those releases are on borrowed time.

Oracle Linux ran its own errata round across OL8, OL9, and OL10. The kernels carry the heaviest load. OL8's 4.18.0-553.164.1 resolves 22 CVEs, most of them use-after-free bugs in the network stack, with xfrm doing most of the damage. OL9's 5.14 kernel and OL10's 6.12 kernel follow the same pattern, with OL10 tucking automotive hardware support into the pile.

The libevent fix is the one to flag for anything web-facing. It clears six CVEs including CVE-2026-63382, an HTTP request smuggling hole through Transfer-Encoding. tomcat shows up three separate times, each working through the same authentication-bypass cluster. perl-Net-DNS for unbounded recursion in TSIG processing lands on both OL8 and OL9.

Then there are the oddballs. The grub2 erratum is almost entirely housekeeping, dropping obsolete dependencies and bumping SBAT metadata. The .NET 10 update is mostly just adding Oracle Linux on top of a standard runtime upgrade. Oracle's usual way of asking you to trust it.

The rest of the batch

AlmaLinux rolled out four security updates for version 8, and the clear heavyweight is OpenSSH. That package picks up three flaws: it can redirect where SFTP downloads land, bypass security via mishandled forwarding and tunneling options in sshd, and trigger a use-after-free bug in the client that leaks information or corrupts data. There's also a bonus fix closing a gap left by an incomplete backport.

The rest reads more like housekeeping. libtiff gets a single patch for an arbitrary code execution bug. apr-util carries the heaviest moderate-severity load with four fixes spanning heap overflows, a timing attack that bleeds passwords, and a denial of service via XML stack recursion. unbound rounds it out with a fix for DNS cache poisoning tied to predictable UDP source ports.

If any of these run on a server you care about, deploy them regardless of the severity label. The CVE summaries make it clear which side wins if you wait.

Fedora's batch is spread across Fedora 43 and 44, and a few advisories quietly cover real holes. The perl-HTML-FormHandler update is the one that raised eyebrows. The Perl form-building class was rendering field attributes into HTML without escaping them (CVE-2026-85630), an easy cross-site scripting hole. Two methods also treated attacker-controlled request data as a Locale::Maketext template, opening the door to method dispatch abuse and resource exhaustion. Four holes across two releases for a form class that honestly shouldn't be doing anything this dangerous.

lego is the more surprising bundle. The Let's Encrypt/ACME client picked up four CVEs in its 5.5.1 bump, all of them living inside third-party libraries it depends on: SSH, the MongoDB driver, and the AWS SDK. That's less "lego fixed a bug" and more "lego swept up a pile of dependency issues." Still, if you issue certificates from a Fedora machine, the update closes those doors.

znc made the same kind of jump, landing on 1.10.3 with fixes for four CVEs including two leftovers from 2020. The clientbuffer module just got rebuilt on top of the new znc, so if you use it you want both packages. That's an IRC bouncer, for those who still detach from their chat. patool's 4.1.0 bump closes a path-traversal hole (CVE-2026-29509) that let arbitrary files land during archive extraction. Not something you'll brag about at parties.

Slackware kept it simple, pushing a security patch for util-linux. The nsenter tool was leaking authority because it left the cgroup.procs file descriptor open after joining a process group. The patched version closes that descriptor, which ties to CVE-2026-78408. Nothing flashy, but a leaked capability is exactly the kind of thing that turns into a privilege-escalation story if you skip the upgrade. You also get 2.42.4 across the board, so routine bug fixes ride along. Run upgradepkg as root, and Slackware ships MD5 signatures so you can verify the download first.

A couple more things worth knowing before you start upgrading. Several kernel and Java notices need a reboot or a service restart after install, not just a plain package update. The strongSwan patch is the notable exception to the "just update it" rule. And the Ubuntu Pro reminder stands: if you're still on an old LTS, most of today's fixes are going to cost you a subscription.

A Detailed Overview of the Updates

AlmaLinux

AlmaLinux rolled out four security updates for version 8, and the clear heavyweight is OpenSSH. That package picks up three separate flaws, all of which let an attacker do things you'd rather not have happening on your box: it can redirect where SFTP downloads land, bypass security via mishandled forwarding and tunneling options in sshd, and trigger a use-after-free bug in the client that leaks information or corrupts data. There's a bonus fix too, closing a gap left by an incomplete backport of an older CVE.

The rest of the batch reads more like housekeeping. libtiff gets a single patch for an arbitrary code execution bug. apr-util carries the heaviest load of the moderate-severity releases with four fixes spanning heap overflows in its redis and memcached clients, a timing attack that bleeds password data, and a denial of service via XML stack recursion. unbound rounds things out with a fix for DNS cache poisoning tied to predictable UDP source ports.

If any of these run on a server you care about, the fix is worth deploying regardless of severity label. The CVE summaries make it clear which side wins if you wait.

Fedora Linux

Fedora rolled out another batch of security updates spread across Fedora 43 and 44. None of this will win design awards, but a few advisories quietly cover real holes in packages you might actually be running.

Two things are worth flagging before the breakdown. First, two of these advisories are the exact same fix: perl-HTML-FormHandler 0.410002 got patched separately for F43 and F44, so you'll read the same CVE list twice. Not a copy-paste error, just Fedora servicing multiple releases. Second, znc and its clientbuffer module share a single advisory (FEDORA-2026-855d5949d1), so the table lists both under one ID.

The perl-HTML-FormHandler update is the one that actually raised eyebrows. The Perl form-building class was rendering field attributes into HTML without escaping them (CVE-2026-85630), an easy cross-site scripting hole. It also had two methods treating attacker-controlled request data as a Locale::Maketext template, which opened the door to method dispatch abuse and resource exhaustion. The newer versions pass that data as arguments instead. Four holes across two releases for a form class that honestly shouldn't be doing anything this dangerous.

lego is the more surprising bundle. The Let's Encrypt/ACME client, written in Go, picked up four CVEs in its 5.5.1 bump, all of them living inside third-party libraries it depends on (SSH, the MongoDB driver, and the AWS SDK). That's less "lego fixed a bug" and more "lego swept up a pile of dependency issues at once." Still, if you issue certificates from a Fedora machine, the update closes those doors.

znc made the same kind of jump, landing on 1.10.3 with fixes for CVE-2026-82373, CVE-2026-82374, and two leftovers from 2020 (CVE-2020-11022 and CVE-2020-11023). The clientbuffer module just got rebuilt on top of the new znc, so if you use it you want both packages. That's an IRC bouncer, for those who still detach from their chat.

patool's 4.1.0 bump closes a path-traversal hole (CVE-2026-29509) that let arbitrary files land during archive extraction. That's a "don't extract random downloads" situation, but path traversal tends to be friendlier to attackers than most exploits, so the update earns its place.

Oracle Linux

Oracle Linux has dropped another errata round across OL8, OL9, and OL10. The updates are sitting in the Unbreakable Linux Network, waiting for you to apply them. Some are light touch-ups, others quietly pull in a couple dozen CVEs at a time.

The kernels carry the heaviest loads. The OL8 kernel (4.18.0-553.164.1) resolves 22 CVEs, most of them use-after-free bugs in the network stack, with xfrm doing most of the damage. OL9's 5.14 kernel (5.14.0-687.49.1) and OL10's 6.12 kernel (6.12.0-211.56.1) follow the same pattern, though OL10 also tucks automotive hardware support into the pile, adding NXP s32g timer drivers and INA2xx sensor support alongside the security fixes. That pairing is standard for these kernel errata: a pile of CVEs, plus whatever feature work happened to fit in.

A few updates stand out from the noise. The libevent fix is the one worth flagging for anyone running something web-facing, since it clears six CVEs including CVE-2026-63382, an HTTP request smuggling hole through Transfer-Encoding. tomcat appears three separate times (OL8, OL9, and OL10), each round working through the same cluster of authentication-bypass CVEs. The perl-Net-DNS patch for unbounded recursion in TSIG processing (CVE-2026-81928) lands on both OL8 and OL9.

Then there are the oddballs. The grub2 erratum is almost entirely housekeeping, dropping obsolete package dependencies and bumping SBAT metadata, while still tucking a CVE or two into the package. The .NET 10 update is mostly just adding Oracle Linux on top of a standard runtime upgrade. The image-builder rebuilds for OL9 and OL10 each ship four CVEs with little else attached, which is Oracle's usual way of asking you to trust it.

Red Hat Enterprise Linux

Red Hat just pushed a batch of 42 security errata across the RHEL lineup, and if any of these packages run on boxes you manage, the update window is open. The headline is that nearly all of them land at the "Important" level, which Red Hat reserves for issues worth acting on quickly. Only three triaged to "Moderate" and one to "Low," so this is mostly routine patching rather than a fire drill.

The reason there are so many entries for a handful of packages is that Red Hat slices each errata by RHEL version and support channel, so a single package can legitimately show up several times. mod_auth_openidc tops the list with seven separate advisories, mostly pointed at the SAP and long-life tracks, which is Red Hat making sure you noticed. Redis, corosync, curl, Firefox, rsyslog, gstreamer and Quarkus each appear more than once across releases. Two of the Quarkus updates (3.27.5.SP2 and 3.33.3.SP2) are worth a glance because they bundle a new release with the security fix rather than dropping a bare patch on top of an old one.

If you sit on Extended Update Support or Advanced Mission Critical, several of these call out those channels directly, so check them before you skip. The CVE details sit on Red Hat's errata page under each RHSA number.

Slackware Linux

Slackware has pushed a security patch for util-linux, and if you run the distro you'll want to apply it. The advisory, SSA:2026-264-01, updates the package across Slackware 15.0 and -current for both 32- and 64-bit builds.

The actual fix is narrow but worth understanding. The nsenter tool was leaking authority because it left the cgroup.procs file descriptor open after joining a process group. The patched version closes that descriptor, which is the whole point of the update. That ties to CVE-2026-78408. Nothing flashy, but a leaked capability is exactly the kind of thing that turns into a privilege-escalation story if you skip the upgrade.

The package itself is 2.42.4 across the board, so you're getting routine bug fixes bundled with the security fix. Installation is as expected for Slackware: run upgradepkg as root against the .txz, and Slackware ships MD5 signatures so you can verify what you downloaded before installing.

Ubuntu Linux

Ubuntu published a fresh batch of security notices. Twenty-two separate notices landed the same day covering XML libraries, Java runtimes, media frameworks, and a pile of Linux kernels. You can skim the headlines and still walk away slightly dizzy.

The kernels are where the numbers get ugly. Five notices patched the Linux kernel across cloud and hardware variants, and two of them carry an uncomfortably long list of CVEs. The Raspberry Pi kernel update (USN-8668-2) alone tracks well over 200 vulnerabilities spanning 2022 to 2026, which includes AMD speculative-execution and cache-isolation flaws. Those are essentially chip design quirks, and no amount of apt update is going to make them disappear, though the kernel bits do get closed off. Same story for the IBM kernel notice. If either applies to your hardware, plan to reboot after applying, and expect the usual ABI-change warning about recompiling third-party modules.

The libraries are the ones most people will actually hit. libxml2 picked up two fixes, one of which lets an attacker run arbitrary code and the other crashes apps via the Python bindings. GLib swallowed a whole cluster of out-of-bounds reads in GVariant, GDateTime, g_regex_replace and friends, each capable of leaking memory or crashing whatever is holding it. Expat, libsoup, and both GStreamer plugin sets showed up as well, each bringing its own mix of crashes and the occasional code-execution risk.

Java gets the regular quarterly treatment, with OpenJDK 8, 11, 17, 21, and 25 all updated for the same trio of authentication-handling bugs. None is likely to keep you up at night, but they patch the same issues across a lot of supported releases at once, so it is worth doing in one pass.

A few specifics worth knowing before you start upgrading. Several kernel and Java notices need a reboot or a restart of the relevant service after install, not just a plain package update. The strongSwan notice is the notable one, since CVE-2026-78134 lets an authenticated user bypass authentication entirely, which is meaningfully worse than the usual denial-of-service crash. And if you are still on 14.04, 16.04, or 18.04, most of these fixes only arrive through Ubuntu Pro, a decent reminder that those releases are running on borrowed time.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all