Today's Linux security roundup spanned eight distros, with Ubuntu's kernel notices carrying a staggering 1,050 CVEs each and Fedora's Chromium bump bundling 247 fixes. Ubuntu's biggest priority is CVE-2023-20585, the AMD SEV-SNP hole that lets local hypervisor attackers corrupt confidential guest memory. Fedora's standout is Chromium 155, alongside Firefox 158.0 and a curl fix for a use-after-free that enables remote code execution over HTTP/2. Across AlmaLinux, Debian, RHEL, Rocky, SUSE, and Slackware, the real RCEs to patch first include pcre2, Dovecot, php8, and the expat integer overflow.

Today's Linux security roundup is dominated by two numbers that really shouldn't be possible

Eight major distros pushed fixes on October 13 and 14. Two of them handed out CVE counts that make you do a quick double take.

Today's security roundup across the Linux distro scene reads less like a normal patch cycle and more like a numbers game. Eight major releases pushed fixes on October 13 and 14, and two of them came out with counts that are genuinely large. Ubuntu's notices carry roughly 1,050 CVEs each. Fedora's Chromium bump ships 247 security fixes in a single build. Both are big enough to make a patch manager groan and an admin wonder how much of it actually matters.

Ubuntu's 1,050-CVE kernel

Ubuntu's security team published ten notices between October 13 and 14, and eight of them are basically the same patch wearing different cloud uniforms. The identical set of vulnerabilities got reissued for AWS, Azure, GCP, IBM, Oracle, and KVM, plus the generic, lowlatency, realtime, and FIPS kernels. The overlap is heavy on purpose.

The kernel notices span from 3.13, the one still powering Ubuntu 14.04 back in 2014, all the way up to 6.8 on 24.04. That's a fourteen-year range of kernel code sitting in a single roundup.

The two worth pausing over are USN-8917-1 and USN-8918-1, both for 24.04, both listing about 1,050 CVEs. The exact figure matters less than the fact that each also folds in CVE-2023-20585, the AMD SEV-SNP hole where a local attacker with hypervisor access can corrupt confidential guest memory. If you run VMs on AMD EPYC, that's the one to prioritize before anything else.

Keep in mind that both notices want a reboot, and you'll need to recompile any third-party kernel modules after the ABI bump.

Fedora and the RCEs that matter

Fedora delivered a batch split between Fedora 43 and 44 on Tuesday, but the real story is a single browser. Both releases picked up Chromium 155.0.8059.39, which bundles 247 security fixes. That's a lot to pack into one release, and it almost makes you suspicious of a product that proudly lists its own security hall of fame in the changelog.

Firefox also jumped, to 158.0 on Fedora 44, while curl picked up three fixes for mTLS connection reuse, an OpenLDAP SASL bypass, and an OpenSSL pinning hole. Same genre of bug the security teams keep coming back to: something that looked bolted shut turned out to be bolted loose again.

The kernel landed at 7.2.10 with a reverted af_alg_restrict sysctl and a new ARM64 errata patch. The grab bag includes Aegisub now forcing you to confirm embedded automation scripts, two binutils cross-compiler tools patched for a buffer overflow, and xdg-dbus-proxy closing a reply-serial gap that let sandboxed Flatpaks step over their own walls. Everything's GPG-signed and drops in through dnf upgrade --advisory, so a background update probably already caught most of it.

The rest of the roundup

AlmaLinux rolled out nine advisories across versions 9 and 10, all rated Important except tftp at Moderate. That's 39 CVEs total, and they all share one release date. pcre2 is the loudest with seven CVEs, and a few of those go past a simple crash into out-of-bounds writes, meaning arbitrary code execution. Dovecot is a close second with eight issues, including an auth bypass through bad OAuth2 validation and a use-after-free via Sieve editheader that also lands you in RCE territory. If your mail server runs anything older than the patched build, grab this one first.

Debian kept it short but sharp. Two advisories, both worth patching before your coffee cools. Curl is the headline: a use-after-free trips when a server sends an HTTP/2 RST_STREAM mid-upload, and this time the payoff is remote code execution instead of a mildly annoying crash. Three more curl CVEs got folded into the same trixie update (8.14.1-2+deb13u7). One wrinkle is that the fix targets stable trixie with no separate bookworm entry, so check whether your older setup is still covered.

Red Hat pushed 19 advisories, sixteen rated Important, with OpenShift Container Platform 4.21.37 as the marquee item stacking a security update on top of its usual work. Firefox shows up four times across the 8.8, 9.2, 9.6, and 10.0 tracks. Rocky Linux handed out fifteen updates across versions 8, 9, and 10, where the kernel patch on Rocky 9 is the one worth glancing at first.

Closing out

SUSE's Tumbleweed half is mostly moderate python bumps, but the important stuff lives in SLE. The php8 patch closes ten CVEs across SLE 15 SP4 and SP5, including the OpenSSL stream peer verification quietly falling back to Common Name when no subjectAltName matches. That footgun has tripped people more than once, so if you still pin TLS to a plain hostname, patch that first.

Slackware kept it simple with expat 2.9.0 for 15.0 and -current, closing an integer overflow in expat_realloc mapped to two CVEs. Pull the .txz from the FTP mirror and run upgradepkg as root, assuming you still enjoy that ritual. The OSU Open Source Lab still fronts those FTP and rsync mirrors, which is a quietly useful piece of infrastructure that never gets the credit it deserves.

So what do you actually do with all of this? Prioritize the RCEs and the AMD SEV-SNP hole, then work through the rest at your own pace. Head here to Red Hat's errata pages for CVSS scores, or check the advisory tracker pages Debian hands out with each notice. If you're on a long-term support release, verify which versions you actually run before assuming coverage, since a number of these are scoped to narrower lanes like EUS or Update Services for SAP.

A Detailed Breakdown of the Updates

AlmaLinux

The latest round of AlmaLinux security errata rolled out, covering nine advisories across AlmaLinux 9 and 10. Nearly everything is tagged Important, with only tftp getting a Moderate rating. The batch is a reminder that the libraries you probably never think about until they break tend to be the ones holding the worst news.

pcre2 is the loudest, carrying seven CVEs. Regex engines have a long and unfortunate habit of blowing up when handed malformed input, and this update is the usual cleanup. A few of those seven go past a simple crash: out-of-bounds writes here translate into arbitrary code execution, which is the kind of finding that makes admins reach for strong coffee.

Dovecot runs a close second with eight issues, including an authentication bypass through bad OAuth2 token validation and an arbitrary code execution path via a Sieve editheader use-after-free. If your mail server is running anything older than the patched build, this deserves your attention before the rest.

Flatpak tells a similar story with four entries. The concerning ones are the local privilege escalation through symlink traversal and the root-level writes coming from extra-data extraction, both of which chew on exactly the sandboxing assumptions you'd rather not think about.

BIND took a DoS-only thrashing with five entries, and the kernel on AlmaLinux 10 absorbed eleven fixes ranging from a double-free in the SMB client to some BPF JIT hardening. OpenTelemetry-collector and gd each bring a single vulnerability, while Jackson rounds out the week with one denial-of-service problem through unbounded numeric parsing. All nine advisories share the same release date and hit 39 CVEs in total.

Debian GNU/Linux

Two Debian security advisories came out, both the kind worth patching before you finish your coffee.

Keystone, the OpenStack identity service, had a gap in how it handled delegated authentication that could have leaked privileged data or let someone climb the privilege ladder. It's closed in 2:22.0.2-0+deb12u5 for Debian 12 bookworm. Unremarkable on its face, but a stale identity service is exactly the sort of thing that turns a quiet afternoon into an incident report.

Curl is the one that grabs attention. A use-after-free bug trips when a server sends an HTTP/2 RST_STREAM mid-upload, and this time the payoff is remote code execution rather than just a mildly annoying crash. Debian swept three more curl CVEs into the same trixie update (8.14.1-2+deb13u7), folding the 13.8 point release fixes straight into the advisory. One wrinkle: the fix targets stable trixie, and there's no separate bookworm entry, so check whether your older setup is still being covered.

Both advisories do the minimum: tell you to upgrade and hand you their tracker pages. No excuses to sit on these.

Fedora Linux

Fedora rolled out a fresh batch of security updates Tuesday, split between Fedora 43 and 44. The loud one is browser work: both releases took Chromium 155.0.8059.39, which carries 247 security fixes in its belly. That's a number that makes you want to pause before trusting a browser that proudly lists its own security hall of fame in the changelog.

Firefox and curl didn't get left on the curb. Firefox 44 jumped to 158.0, and curl picked up three fixes covering mTLS connection reuse, an OpenLDAP SASL bypass, and an OpenSSL pinning hole. Same genre of bug the security teams keep returning to: something that looked bolted shut wasn't.

On the system side, the Linux kernel landed at 7.2.10 on both Fedora releases. The summary doesn't scream, but it does include a reverted af_alg_restrict sysctl and a new ARM64 errata patch, so the stable-tree cleanup wasn't entirely cosmetic.

Then there's the grab bag. Aegisub now forces you to confirm before loading embedded automation scripts, two binutils cross-compiler tools got patched for a buffer overflow, and xdg-dbus-proxy closed a reply-serial gap that let sandboxed Flatpaks step over their sandbox lines. python-jupytext swept up a pile of dependency CVEs, mostly sitting in HTML sanitizers and URL parsing code.

All of it is GPG-signed and drops in through the usual dnf upgrade --advisory path, so if you're on either release, a background update probably already caught most of it.

Red Hat Enterprise Linux

Red Hat pushed out another round of errata, and this batch is mostly about closing holes than throwing a party. Of the 19 advisories here, 16 come in as Important-rated security fixes and 3 are Moderate. If you run a fleet of RHEL systems, you've probably got a patching session queued up.

The marquee item is OpenShift Container Platform 4.21.37, which stacks a security update on top of its normal bug-fix and enhancement work. Below that, the list reads like a roster of background packages you'd only know about if a CVE caught your eye: librabbitmq, tftp, OpenEXR, pcre2, libsoup3, and three opentelemetry-collector refreshes. Firefox alone shows up four times across the 8.8, 9.2, 9.6, and 10.0 tracks, which is about as consistent as it gets.

If you touch the critical real-time kernel, the kernel-rt update (RHSA-2026:82806) deserves a look, as do the two kpatch entries that hot-patch a 6.12 kernel without a reboot. Red Hat Service Interconnect 2.2.3 arrives as Moderate, in both RPM and image form. A number of these are scoped to narrower support lanes like Update Services for SAP Solutions and Extended Update Support, so verify which versions you actually run before assuming coverage. CVSS scores for each issue sit behind the CVE links on Red Hat's errata pages.

Rocky Linux

Rocky Linux just pushed a batch of security errata, and this round you've got fifteen updates to get through across versions 8, 9, and 10. Thirteen land at Important severity, two come in at Moderate. Not all of it is a fire drill, but the kernel update is the one worth glancing at before anything else.

Kernel fixes always carry more weight than the rest, so that Rocky Linux 9 patch deserves a look first. Add the LibreOffice fix and the Jackson Java stack update, and that's the trio most servers would grab before the crowd.

Rocky Linux 8's slice is smaller: five updates, all Important except the glibc bump, which lands at Moderate. Rocky Linux 10 shows up barely at all, a single tftp fix rated Moderate.

If you're running anything in that list, pulling the errata is the obvious move. Each entry carries a CVSS score so you can judge how bad each hole actually is rather than trusting the label alone.

Slackware Linux

Slackware just rolled out updated expat packages for both 15.0 and -current, and as usual the motivation is a security hole. The fix is fairly specific: an integer overflow in the expat_realloc function on 32-bit platforms, plus a guard that actually checks the len parameter against available buffer capacity in XML_ParseBuffer. Both gaps map to CVE-2026-102633 and CVE-2026-77214.

The numbering on those CVEs looks a touch odd for a security bulletin, but the underlying issues are the kind you want to close before something higher up the stack starts crashing. The upgrade lands at expat 2.9.0 across four builds, split between 32-bit and 64-bit for each release line.

Getting it is the usual Slackware ritual: pull the .txz from the FTP mirror and run upgradepkg as root. MD5 sums are published for sanity-checking, and the packages carry the Slackware Security Team's GPG signature. The OSU Open Source Lab still fronts the FTP and rsync mirrors, which is a quietly useful piece of infrastructure that never gets the credit it deserves.

SUSE Linux

SUSE rolled out a batch of security fixes, and the shape of the day is what you'd get used to: a long line of moderate python bumps for Tumbleweed, then a heavier set of important-rated patches for older SLE releases that actually pull you in.

The Tumbleweed half is mostly housekeeping. Ten python313 (with python314 tagging along) packages picked up a patch release, each shutting either one or a handful of CVEs. Most land low on the severity scale. The one worth a real look is python313-mysql-connector-python, which carries CVE-2019-2435 at an 8.1, letting a fake server coax the connector into handing over credentials. Funny thing, you'll notice: SUSE graded that whole announcement "moderate" despite an 8.1 CVE riding inside it. Take that as you will. The rest, including oic, oci-sdk, mpmath, and marshmallow, are quiet version bumps.

The second story is where the damage actually is.

The php8 patch (SUSE-SU-2026:4651-1) is the largest single catch, closing 10 CVEs across SLE 15 SP4 and SP5. The list reads like a grab-bag of textbook web bugs: a SOAP parser that recurses until it chokes, credential leakage via cross-origin HTTP redirects, an access-control bypass from a partial IPv6 comparison, and the one that draws the most eyes. OpenSSL stream peer verification quietly falling back to Common Name when no subjectAltName matches. That particular footgun has tripped people more than once, so if you still pin TLS to a plain hostname, patch that first.

Xorg splits across two announcements for the same 11 vulnerabilities, one for SP5 (4645-1) and a separate one for the newer SP6 (4647-1). The CVE names tell the story without further comment: double frees, use-after-free in the Present and XInput extensions, heap overflows, numeric truncation. Mostly local, which is the catch. A local attacker sitting in front of the X server is not a casual threat model, it's a privilege-escalation conversation.

Xen shows up twice too, for the 15.4/SP4 line and the 15.5/SP5 line, four CVEs each plus one non-security fix in the SP5 variant. SUSE flags reboot explicitly on both. These aren't the sort you patch and keep running.

virtualenv and urllib3 wrap up the important tier with two CVEs each. The urllib3 pair is a DoS one-two out of chunked Deflate decoding, and the virtualenv bugs cover tamperable network wheels and config-key injection through crafted prompts.

Ubuntu Linux

Ubuntu's security roundup is a monument to how the distro ships kernel fixes: eight of the ten notices published between October 13 and 14 are basically the same patch wearing different cloud uniforms. That identical set of vulnerabilities got reissued for AWS, Azure, GCP, IBM, Oracle, KVM, and the plain generic, lowlatency, realtime, and FIPS kernels, which is why the overlaps are so heavy. Together the kernel notices span versions from 3.13 (the one still powering Ubuntu 14.04) up to 6.8 on 24.04, covering releases from Trusty in 2014 to 26.04.

The two worth pausing over are USN-8917-1 and USN-8918-1, both aimed at Ubuntu 24.04. Each lists about 1,050 CVEs. The exact figure matters less than the fact that both also fold in CVE-2023-20585, the AMD SEV-SNP hole where a local attacker with hypervisor access can trip an out-of-bounds condition and corrupt confidential guest memory. If you run VMs on AMD EPYC, that is the one to prioritize before anything else.

The rest of the kernel notices are more routine. USN-8924-1 reaches back to 14.04's 3.13 kernel and sweeps up a small museum of old bugs: an XFS validation gap, a F2FS metadata flaw, an epoll and Unix-socket use-after-free, a Qualcomm 60GHz wireless integer overflow that could escalate to code execution, and a handful more attributed to well-known researchers like Jann Horn and Wen Xu. USN-8923-1 covers 14.04 and 16.04 with SCSI and Bluetooth fixes, while USN-8922-1 (Oracle), USN-8921-1 (broad 18.04/16.04/14.04), and USN-8920-1 and USN-8919-1 (20.04/18.04) handle the usual per-flavor kernel updates.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Slackware (slackpkg and pkgtool)

Slackware doesn’t have a single unified updater, but the official way to pull updates is through slackpkg. Start with sudo slackpkg update to download the newest package list from the chosen mirror. Then run sudo slackpkg upgrade-all; this command walks through each installed package and replaces it with the most recent build available in the official repository. For users who prefer a more granular approach, specifying a package name after upgrade limits the operation to that single item. When dealing with community‑maintained repositories, pkgtool takes over: a combined sudo pkgtool update && sudo pkgtool upgrade will sync and apply updates from the mirrors listed in /etc/slackpkg/mirrors.

sudo slackpkg update
sudo slackpkg upgrade-all