SUSE just closed 110 vulnerabilities in a single SUSE Linux Enterprise 15 SP5 kernel update, the biggest single bump of the day. The week's only Critical ratings both point at the idm:DL1 identity-management module on RHEL 8 and Rocky Linux 8, with Oracle's lone Critical landing on 389-ds-base for OL7. Debian spent most of its bullets on browsers, shutting roughly 59 CVEs in firefox-esr and 37 in Chromium, while Oracle leaned on raw volume across its kernel and Thunderbird updates. Ubuntu wrapped up with three notices, including a reboot-required Azure kernel change on 16.04 LTS and a 12-issue RabbitMQ fix spanning 16.04 through 26.04.

Today's Linux security roundup: SUSE kernel eats 110 CVEs, RHEL and Rocky chase a critical identity patch

SUSE's security team just closed 110 vulnerabilities in a single kernel, putting SUSE Linux Enterprise 15 SP5 near the top of today's patch pile. The actual "fix now" items, though, are spread across RHEL, Rocky, and Oracle, where identity-management modules got flagged Critical.

Schedule a reboot and grab a coffee or two. That's the honest summary of what landed today across the major distros.

The two criticals both live in one module

If you're keeping score, note that today's lone Critical ratings almost all point at the same place. The idm:DL1 identity-management module got flagged Critical on both RHEL 8 and Rocky Linux 8. Red Hat split its hit across two advisories, RHSA 83460 for the base module and RHSA 83461 for the SAP and Telecommunications Update Service channels. Rocky lists the identical advisory under the same number, RSA-2026:83460, and it reaches into roughly two dozen IPA-related packages. That overlap is convenient, though not surprising.

Oracle's lone Critical sits on the other end of the family tree. 389-ds-base on Oracle Linux 7 (ELSA-2026-64771) takes four CVEs and lands at Critical. If you run directory services on OL7, open that one first.

SUSE's 110-hole kernel is rated Important rather than Critical, but the volume alone makes it headline-worthy. It covers the base Server, SAP, and High Performance Computing builds, plus Live Patching, Micro, Real Time, and LTSS. openSUSE Leap 15.5 rides along. SUSE counts ten features and seven security fixes on top of the flood, which is a slightly generous way to describe 110 closures.

A handful of these score 9.8 under NVD's math: ipvs one-packet flag handling, nvmet-tcp, the smb client's dirent bounds. SUSE rates several of them lower, sometimes by a couple of points, so read that gap as a judgment call on exploitability rather than a mistake. Race-condition fixes threaded through sctp, vxlan, and the wider networking stack are the boring, reliable kind. Reboot after installing, which is the part people always forget until the box won't start.

The browsers are where Debian spent its bullets

Debian's biggest single fix today is firefox-esr, which gets roughly 59 CVEs shut. That spans arbitrary code execution, sandbox escapes, and privilege escalation for a browser people use to read the web. Debian ships it for Debian 12 under DLA-4836-1 and runs a parallel ELA-1845-1 through FreeXian to cover the older Debian 11 bullseye with the same fixes.

Chromium gets the same double treatment. You get 37 CVEs across a trixie stable build and a bookworm LTS build. Two browsers, two releases, same family of flaws.

MariaDB shows up with six CVEs plus a quirkier bonus. Debian's patch also corrects a board server exposure caused by new upstream systemd start-up files squabbling with older Debian packaging helpers. That's the sort of version-compatibility headache that bites people who weren't paying attention.

The GStreamer plugins see it both ways too. gst-plugins-good1.0 takes 13 CVEs and gst-plugins-bad1.0 adds nine, both turning specially crafted media files into denial-of-service, memory disclosure, or code execution.

The rest of Debian's stable batch is smaller but sharp. expat pulls six CVEs for malformed XML, jpeg-xl takes one for an unsanitised APNG parser, and mutt trips over Content-Type headers. SPIP hands out unauthenticated remote code execution, and Debian still hasn't assigned it a CVE number, which is always a little unsettling. cifs-utils closes the set with a privilege escalation hole.

Oracle's story is volume, plain and simple

Oracle pushed another large errata round across OL 10, 9, 8, and 7, and the kernel does most of the heavy lifting. OL 9's UEK bump (ELSA-2026-50038, kernel 55.15.0-325.221.6.2) is a monster: eventpoll use-after-free, landlock, ntfs3, hsr, and a large batch more. The OL 8 UEK entry carries the same erratum.

Thunderbird collected roughly 40 CVEs in one shot (ELSA-2026-80694, up to ESR 140.17.0 with OpenELA debranding), and LibreOffice came away with four.

If you patch only one thing today, make it microcode_ctl for OL 9 and OL 10 (ELSA-2026-67979 and ELSA-2026-68011, both shipping Intel microcode build 20260812). Those land fresh CPU microcode tied to Intel's own security advisories, which is worth more than the usual backported housekeeping you'll find for pcre2, gd, and flatpak-builder.

A couple of Oracle entries are plain bug-fix or enhancement notices rather than security fixes. linux-firmware for OL 8 and tzdata for OL 7 show up as Info-rated, so don't lump them in with the actual CVEs.

AlmaLinux's pile is deep but mostly printer trouble

AlmaLinux pushed 22 advisories between October 15 and 16 across versions 8, 9, and 10, with nearly all rated Important and only two moderate ones mixed in. The single biggest hit is HPLIP, HP's printer driver stack, which took 11 CVEs apiece in the v9 and v10 updates. Heap overflows, remote code execution, privilege escalation. That's a lot of printer trouble for one release.

LibreOffice is nowhere near spotless either, carrying an arbitrary code execution path through a remote Java database driver alongside a couple of buffer overflows.

The usual kernel pileup lands on v8 and v9, loaded with use-after-free bugs across networking and scheduling code plus some ALSA heap overflows, with kernel-rt getting the identical treatment for real-time workloads. Ghostscript appears three times across all three versions with the same pair of CVEs, and rpcbind shows up three times too, this time with an unauthenticated remote denial-of-service that really means unbounded memory allocation waiting to be exhausted.

On the lighter side, Node.js 24 was rebaselined to its latest release, and libsoup picked up a cluster of WebSocket heap overflow patches. The Grafana advisory is the one to circle: a plugin archive that extracts itself outside the plugin directory and runs code. If you install plugins, that one goes near the top of your list.

Ubuntu keeps it to three

Ubuntu shipped just three notices on October 15, but one of them is a whole procedure. USN-8922-2 hits the Azure-flavored kernel on Ubuntu 16.04 LTS with eleven flaws across S390, PCI, VFIO, NFS, overlay filesystem, IPv6, and Netfilter. The patch bumps linux-image to 4.15.0-1208.223~16.04.1, but the ABI changed. That means any third-party kernel modules you built yourself have to be rebuilt. An ordinary system upgrade usually handles that unless you manually stripped the standard kernel metapackages earlier. The package sits behind Ubuntu Pro and requires a reboot.

The Go notice on 22.04 LTS (USN-8883-2) is a follow-up to one that already covered 1.18, 1.21, and 1.24. It finally fixes 1.23, where x/net/idna mishandled certain Punycode labels and let attackers slip past hostname-based access controls. Just a package update, nothing elaborate.

The RabbitMQ notice (USN-8933-1) is the one where you start counting. Twelve issues span AMQP across Ubuntu 16.04 all the way to 26.04. Some you'd patch on principle, credentials stored in an insecure cookie, TLS client authentication easily bypassed, while one or two make you wonder how they shipped, like OAuth bearer tokens leaking through bootstrap JavaScript. Each LTS release gets its own package version. Apply the update, then restart the service.

A Detailed Breakdown of the Updates

AlmaLinux

AlmaLinux pushed a fresh round of errata between October 15 and 16, and if you run any of versions 8, 9, or 10 there's a healthy pile of security updates to work through. Twenty-two advisories landed, nearly all marked Important with two moderate ones mixed in.

A few things jump out. HPLIP, the HP printer driver stack, took the biggest single hit: two advisories, one each for v9 and v10, each folding in 11 CVEs that range from heap overflows to remote code execution and privilege escalation. That is a lot of printer trouble in one release. LibreOffice is not spotless either, carrying an arbitrary code execution route through a remote Java database driver alongside a couple of buffer overflows.

The usual kernel pileup shows up on both v8 and v9, this time loaded with use-after-free bugs across the networking and scheduling code plus some ALSA heap overflows, and kernel-rt gets the identical treatment for real-time workloads. Ghostscript appears three times across v8, v9, and v10 with the same pair of CVEs, and rpcbind shows up three times as well with an unauthenticated remote denial of service that really comes down to unbounded memory allocation waiting to be exhausted.

On the lighter side, Node.js 24 was rebaselined to the latest release on top of its security fixes, while libsoup and libsoup3 picked up a cluster of WebSocket heap overflow patches. The Grafana advisory earns a small smile: a plugin archive that extracts itself out of the plugin directory and runs code. If you install plugins, that one goes near the top of your list.

Debian GNU/Linux

Debian's security team delivered another batch of patches this week, and the biggest by a wide margin is firefox-esr. The Extended Support Release gets roughly 59 CVEs shut, fixing problems that ranged from arbitrary code execution to sandbox escapes and privilege escalation. It is a lot of holes for a browser people rely on to open the web, though you probably want it patched before something in that list gets exploited. Firefox-esr is under LTS for Debian 12, and FreeXian is running a parallel ELA-1845-1 to cover the older Debian 11 bullseye with the same fixes.

Chromium gets the same double treatment. You get a trixie stable release plus a bookworm LTS build, both carrying 37 CVEs. Two browsers, two releases, same family of flaws.

MariaDB shows up with six CVEs plus a quirkier secondary fix. The patch also corrects board server exposure caused by new upstream systemd start-up files squabbling with older Debian packaging helpers, which is the kind of version-compatibility headache that tends to bite people who weren't paying attention.

The GStreamer plugins see action on both ends too. gst-plugins-good1.0 picks up 13 CVEs and gst-plugins-bad1.0 adds 9 more, both bothered by specially crafted media files turning into denial-of-service, memory disclosure, or code execution.

The remaining trixie (stable) advisories are fewer per package but sharp. expat (6 CVEs) and jpeg-xl (one CVE, an unsanitised APNG parser) both break on malformed input. Mutt trips over Content-Type headers, and SPIP hands out unauthenticated remote code execution, though Debian still hasn't assigned a CVE number to it, which is always a little unsettling. cifs-utils closes out the set with a privilege escalation hole.

Oracle Linux

Oracle pushed another big errata round to the Unbreakable Linux Network, and the volume is the story here. You've got updates rolling out across OL 10, 9, 8, and 7, with the kernel errata carrying most of the weight. The UEK (Unbreakable Enterprise Kernel) bumps alone bring dozens of CVEs each, and OL 9's UEK update is a monster that includes the upstream eventpoll use-after-free that showed up back in the news. Thunderbird picked up roughly 40 CVEs in one shot, and LibreOffice came away with four.

If you're going to patch one thing and nothing else, the microcode_ctl updates for OL 9 and OL 10 are the ones that matter most, since they land fresh Intel CPU microcode tied to a stack of Intel security advisories. The low-end fixes (pcre2, gd, flatpak-builder) are the usual backported housekeeping. A couple of entries are plain bug-fix/enhancement advisories rather than security ones, which you can see flagged in the table.

Red Hat Enterprise Linux

Red Hat has pushed a batch of 39 advisories this cycle, and the loudest one is the two rated Critical. Both hit the idm:DL1 module on RHEL 8. One covers the base module; the other lands on the SAP and Telecommunications Update Service channels. If you run identity management on those platforms, this is the batch to patch first.

Past the Critical tier, the bulk sits at Important and it is spread wide. Kernel shows up twice (RHEL 9 and RHEL 10), openssl gets bumped on the 9.6 EUS track, and firefox closes out on the aging RHEL 7 Extended Lifecycle Support channel. mariadb-connector-c and ruby each collect four separate updates, while ghostscript, rpcbind, and libsoup (plus libsoup3) round out the most-hit libraries.

OpenShift eats up the most individual advisories of anything here, with nine entries spanning 4.12, 4.13, 4.16, 4.17, and 4.18. The 4.12.100 and 4.13.72 releases carry an Important rating overall but only a Low security impact inside them, so treat those as scheduled housekeeping rather than an emergency. A couple of other details worth knowing: the wireshark update for RHEL 8 lands at Moderate, one rung below its RHEL 9 sibling, and Debezium 3.6.3 plus Quarkus 3.33.4 and 3.27.6 are release-only entries. Several of these only appear on EUS, SAP Solutions, or the Advanced Mission Critical channels, so check your subscription before assuming a package is current.

Rocky Linux

Rocky Linux just shipped a batch of errata updates, and if you're running Rocky Linux 8, you have some installing to do. The headline item is a Critical security, bug fix, and enhancement update for idm:DL1, the identity management domain that bundles IPA, DNS, and the surrounding pieces. It touches a sprawling list of modules, which is exactly how these things usually go when they reach into the whole identity stack.

A bunch more lands alongside it: an Important python36 update covering a grab-bag of Python packages, separate Important updates for both the regular kernel and the real-time kernel, and an Important hplip (printer driver) update aimed at the newer Rocky Linux 10. A Moderate update for environment-modules rounds out the batch.

Two of these entries are just the same advisory duplicated in the source, so don't count the double-listed idm:DL1 and python36 as separate issues.

SUSE Linux

SUSE published a security update for the SUSE Linux Enterprise 15 SP5 kernel that closes 110 vulnerabilities. That is a number that should make you glance at your patch history. The same release also brings ten features and seven security fixes by SUSE's own count, though the vuln tally is obviously the point.

Affected machines cover the standard SLE 15 SP5 family: the base Server, the SAP and High Performance Computing variants, Live Patching, Micro, Real Time, and the LTSS builds, with openSUSE Leap 15.5 riding along. You will reboot after applying, which is the part everyone forgets until the box starts acting up.

The severity spread is worth a look. A handful score 9.8 under NVD's counting, hitting things with network access like the ipvs one-packet flag handling, nvmet-tcp, and the smb client's dirent bounds. SUSE rates several of those same issues lower, sometimes by a couple of points, and that gap is worth a second glance. The RACE-condition fixes threaded through sctp, vxlan, and the networking stack are the unglamorous, reliable kind of patch.

The rest of the batch is far quieter. Ten separate openSUSE announcements, all rated moderate, touch python313 packages on the openSUSE Tumbleweed GA media, with python314 builds shipped alongside each. The biggest single hit is python313-requests with five CVEs, while python313-rsa, rpyc, and redis each take on two. The remaining packages: pywbem, python3-saml, reportlab, rope, python-multipart, and python-rapidjson, each close just one.

Ubuntu Linux

Ubuntu shipped three security notices on October 15, and this batch is the kind that makes you schedule a reboot and maybe a coffee.

The most substantial one hits the Azure-flavored Linux kernel on Ubuntu 16.04 LTS. Eleven separate flaws spread across subsystems you probably don't spend time thinking about (S390, PCI, VFIO, NFS, overlay filesystem, IPv6, Netfilter) could let an attacker take over a box. The patch bumps linux-image to 4.15.0-1208.223~16.04.1, but there's a wrinkle: the ABI changed, so any third-party kernel modules you built yourself need rebuilding. An ordinary system upgrade handles that for you unless you manually stripped out the standard kernel metapackages earlier. A reboot is required, and the package sits behind Ubuntu Pro.

Then there's Go on Ubuntu 22.04 LTS. This is the follow-up to a notice that already covered versions 1.18, 1.21 and 1.24, finally fixing 1.23. The x/net/idna package mishandled certain Punycode labels, letting an attacker slip past hostname-based access controls and escalate privileges. Fixed in golang-1.23 1.23.1-1~22.04.3. Just a package update, nothing elaborate.

The RabbitMQ notice is the one where you start counting. Twelve issues across the AMQP server span Ubuntu 16.04 all the way to 26.04. Some you'd patch on principle (credentials stored in an insecure cookie, TLS client authentication easily bypassed), a handful are denial-of-service quirks, and one or two are the kind of thing that makes you wonder how it shipped (OAuth bearer tokens leaking through bootstrap JavaScript). Each LTS release gets its own package version, since RabbitMQ moved through several major releases across the lineup. Apply the update, then restart the service.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y