Six Linux distributions shipped security updates today, with the biggest priorities being a DNS resolver called unbound and major browser patches. Unbound earned Critical ratings across three distros due to remote code execution and DNSSEC flaws that can expose entire networks. The browser bomb came from SUSE (63 vulnerabilities in Firefox ESR), Thunderbird (44 CVEs on AlmaLinux), and Debian's Chromium (108 CVEs), all driven by use-after-free and privilege-escalation bugs. Patch your resolver and browser first, then work through the smaller, more surgical advisories in the coming maintenance window.

Linux security updates: six distros ship unbound Criticals and a Chromium flood

AlmaLinux, Debian, Fedora, RHEL, Rocky Linux, and SUSE all pushed advisories this week. Patch your DNS resolver and your browser first.

Today's Linux security roundup is the familiar kind. Six major distributions rolled out updates, and somewhere in there you've got two Critical fixes plus a browser that swallowed over a hundred vulnerabilities. If you run a DNS resolver or anything Firefox-based, treat this as a priority pile rather than a later.

The shape of the batch is worth a glance before you start patching. Some advisories touch a single package. Debian's Chromium update pushed more than 100 CVEs in one go. You'll likely reboot at least once. Maybe twice.

Unbound is the Critical you'll spot everywhere

The thread running through this round is a DNS resolver called unbound, and it's the reason three distros managed a Critical rating.

AlmaLinux splits its two Criticals between two products. Unbound takes the top slot with three CVEs: a remote code execution tied to CNAME synthesis plus two DNSSEC heap buffer overflows. Since it's a resolver, a hole here doesn't just bite one machine. It reaches an entire network. FreeIPA is the other Critical, with eight issues including an unauthenticated denial of service and recovered credentials an outside attacker could reach. Eight is a lot to hand an adversary on an identity-management product.

Red Hat kept it tighter. Three advisories, all Critical. Two of them are unbound on RHEL 8.4 and 8.6, both covered under the Advanced Mission Critical Update Support and the Extended Update Support add-ons, so aging systems aren't simply written off. The third is a kernel fix for NVIDIA for RHEL 10, root-in-the-hardware-level. Here's the annoying part: Red Hat didn't spell out any CVE numbers. You'll have to chase the references to figure out the actual blast radius, which is the usual move for these summaries but still leaves you doing homework.

Rocky Linux rounded it out with its own Critical for unbound. The rest of its ten errata cluster at Important, and kernel pulls the most volume with three updates split between Rocky 9 and the newer Rocky 10. Everything's clobbered into single packets, which is the vendor way of saying one update covers a lot of ground.

On the smaller side, AlmaLinux's batch also carries python-cryptography, perl-DBI, and libxml2 across all three releases, plus Apache Tomcat with two fixes and a patch for a Java 8 connection hang. The kernel gets a double dose on AlmaLinux 9. Two separate advisories carry 13 CVEs each, plus driver and networking backports. If you run a custom kernel, read the specifics instead of assuming a single update covers you.

Browsers are getting flooded

If the resolver is the quiet Critical, the browsers are the fire drill.

SUSE's update is the loudest. Firefox ESR jumped to 153.3.0 and cleared 63 vulnerabilities. That's a number you'd normally spread across several months of advisories. Use-after-frees, sandbox escapes, privilege escalations spread across WebRender, CanvasWebGL, Service Workers, and probably more. If you run Firefox on anything, install this before anything else.

AlmaLinux's Thunderbird rides the same wave. Because it reuses Firefox internals, it picks up an even messier tally: 44 CVEs across IMAP parsing, MIME handling, and shared graphics and DOM code. The Firefox update itself carries 28 fixes, mostly use-after-free and privilege-escalation bugs.

Debian's Chromium is where the count goes absurd. 108 CVEs for code execution, denial of service, and information disclosure, landing in trixie at 154.0.8037.57. Node.js trails with 15, one of which smuggles in a permission-model bypass. PHP 8.4 got the usual laundry list of ten, from broken TLS-certificate validation to access-control bypasses.

Then there's the long tail. Ghostscript and VLC each took fixes for DoS or RCE from malformed input. Incus, the container and VM manager, picked up a guest-to-host privilege escalation but no CVE yet, which just means the fix is already sitting in trixie and Debian hadn't assigned a number.

Keep in mind the LTS lines aren't forgotten. Debian patched evolution-data-server to close a hole that let a Flatpak with addressbook access delete arbitrary host files, and Extended LTS added Redis on the old bullseye line to kill a use-after-free in TLS handling that would otherwise let someone run commands as the server.

Fedora's messiest advisory landed in libheif, the image library that quietly renders photos on basically every Fedora desktop. Fedora 43's update carries 14 CVEs, including an out-of-bounds write in image tile handling (CVE-2026-84444) that runs arbitrary code from a crafted image. Fedora 44 gets the trimmed edition, seven CVEs deep but without the freshest ones. sipp pulled off less dramatic fixes: three DoS bugs from oversized SIP headers and authentication parameters. And libpcap made the biggest version jump, to 1.10.7, sealing seven CVEs including an out-of-bounds read in the rpcap client that could leak memory.

Here's a small one that has nothing to do with the actual vulnerability. The Fedora update notice mislabels libpcap's version as "10.7.1" before correcting itself in the changelog. Don't go hunting for a package called 10.7.1. It doesn't exist.

Beyond the big names, the rest is housekeeping, and it's spread across the remaining distros.

SUSE alone shipped a dozen advisories. Its only other Critical is 389-ds, the LDAP directory server, with six issues including an unauthenticated LDAP filter injection and a path to climb up to Directory Manager. It also pulls in a pile of non-security fixes, from stack overflows to a rust dependency bump. GIMP quietly absorbed 11 fixes, several of them RCE bugs you'd trigger just by opening a maliciously crafted TIF, PSD, SGI, or ICO file, so there's now a marginally safer way to load images, given the program's history. Worth a wince.

There's also sdbootutil with eight vulnerabilities in the rust-openssl crate it wraps, a kbd local-privilege-escalation fix in openvt, and the kind of thing that makes sysadmins sigh: an openSUSE-signkey cert that hands you a new UEFI signing key you'll need to import through the MOK dialog on your next boot. Tumbleweed picked up a long tail of moderate updates, and several are just CVE references being added to fixes that were already shipped.

An Overview of the Updates

AlmaLinux

If you administer any AlmaLinux 8, 9, or 10 boxes, there is a sizable chunk of patching to get through. AlmaLinux pushed 15 security advisories and several of the packages on the list are exactly the kind that should make a person doing server work set down their coffee: Firefox, Thunderbird, the Linux kernel, Unbound, and FreeIPA. They are not all worth the same effort, though. Two landed at Critical severity, one sits at Moderate, and the rest cluster around Important.

Firefox is the loudest thing here. Mozilla tends to ship a large security release once or twice a year, and this one nearly touches every component it owns, from the JavaScript JIT engine to CanvasWebGL. The Firefox advisory alone carries 28 fixes, most of them use-after-free or privilege-escalation bugs. Thunderbird rides on the same wave, and since it reuses Firefox internals it picks up an even messier tally: 44 CVEs spanning IMAP parsing, MIME handling, and the shared graphics and DOM code.

The kernel gets a double dose on AlmaLinux 9. Two separate advisories pull in about 26 CVEs each plus a set of driver and networking backports, so if you are running a custom kernel it is worth actually reading the specifics instead of assuming a single update covers you.

The two Criticals are the ones to grab first. Unbound fixes three DNSSEC issues, including two heap buffer overflows and one remote code execution tied to CNAME synthesis. Since it is a resolver, a hole here affects a whole network rather than a single machine. FreeIPA gets eight, including unauthenticated denial of service and a couple of credentials-recovery paths an outside attacker could reach, which is the sort of thing you want locked down on an identity-management product. The rest of the batch is smaller and more surgical: python-cryptography takes one (a path-building problem with duplicate self-signed intermediates), perl-DBI takes one (an out-of-bounds write through an unvalidated placeholder), and libxml2 shows up on all three supported releases with a handful of buffer overflows. Apache Tomcat gets two fixes, eight CVEs between them, plus a patch for a Java 8 connection hang.

Debian GNU/Linux

Debian pushed out a round of security fixes and the browser batch is the one you'll want to apply before your morning coffee goes cold.

Chromium took the biggest hit, picking up over a hundred CVEs for code execution, denial of service, and information disclosure. It lands in trixie at version 154.0.8037.57. Node.js isn't far behind with 15 CVEs that also smuggle in a permission-model bypass. PHP got the full laundry list: ten issues spanning bad TLS-certificate validation to access-control bypasses, so if you run anything on PHP 8.4 you have plenty of reasons to upgrade.

DoS and possible remote code execution round out the rest. Ghostscript, VLC, and the Incus container and virtual-machine manager each got new fixes for DoS or RCE issues that malformed input can cause. Incus notably hasn't been assigned a CVE yet, which simply means the fix is already sitting in trixie and Debian hadn't slapped a number on the hole.

The long-term-support releases are where a couple of these get interesting. Debian LTS patched evolution-data-server with a path-canonicalization fix that closes a hole letting a Flatpak with addressbook access delete arbitrary host files, including Flatpak override files. lemonldap-ng fixed an access-rule bypass that let attackers slip past the admin interface using percent-encoded characters or dot-segments, along with lesser nits like passwords served up in plain text. Extended LTS picked up Redis on the old bullseye line to close a use-after-free in TLS handling that would have let an unauthenticated remote attacker run commands as the server.

The fixed versions are broken down below.

Fedora Linux

The HEIF and AVIF image library quietly renders photos on just about every Fedora desktop, so it makes sense that the messiest advisory landed there. Fedora 43's libheif update carries 14 CVEs, several of them denial-of-service issues and at least one out-of-bounds write in image tile handling (CVE-2026-84444) that lets a crafted image run arbitrary code. Fedora 44 gets the trimmed edition, still seven CVEs deep but without the more recently disclosed ones.

sipp, the SIP traffic-generation tool, pulled off less dramatic fixes. Three Denial of Service bugs came from oversized SIP headers and authentication parameters, none of which should have bogged the parser down in the first place. Not a code-execution story, just a noisy network utility choking on packets it probably shouldn't have swallowed.

libpcap took the biggest version jump, moving to 1.10.7 and sealing seven CVEs, including an out-of-bounds read in the rpcap client that could leak memory. The update notice itself mislabels the version as "10.7.1" once before correcting it in the changelog, but that's the notice's problem, not yours.

Red Hat Enterprise Linux

Red Hat has pushed three more security advisories its way, all sitting at the top of the severity ladder. If you run any of these stacks, this is the "patch now" pile, not the "get to it eventually" pile.

Two of the three hit unbound, Red Hat's DNS resolver, landing on RHEL 8.4 and 8.6. You'll find them tagged for both the Advanced Mission Critical Update Support and the Extended Update Support Long-Life Add-On, so there's a path for systems you'd otherwise write off as aging. The third is a kernel update aimed at NVIDIA-for-RHEL on version 10—slightly more niche, but still a root-in-the-hardware-level fix.

Every one is rated Critical by Red Hat's Product Security team, which means CVSS scores available through the linked CVEs. No CVE numbers or specifics are spelled out in the advisory itself, so the actual blast radius isn't fully clear without chasing down the references. That's standard for these summaries, but it does leave you filling in the gap.

Rocky Linux

Rocky Linux just pushed a fresh batch of security advisories, and if your stack runs anything close to current, you probably have a reason to patch. Ten errata went out under the RLSA-2026:7xxxx umbrella, with most landing on Rocky Linux 9. The one flagged Critical is for unbound, a DNS resolver, meaning whoever manages to trigger the underlying flaw gets a much nicer view into your network than you'd want.

Kernel gets the most volume here, with three updates spread across the branches: two for Rocky 9 (RLSA-2026:71232 and RLSA-2026:71700) and one for the newer Rocky 10 (RLSA-2026:71602). All three carry the usual "Important" mix of security, bug fix, and enhancement language, which is the vendor way of saying they clobbered everything into a single packet.

The remaining advisories are more scattered. perl-DBI and libxml2 each landed on both Rocky 8 and Rocky 9. Firefox appeared only on Rocky 8 (RLSA-2026:71652), and python-cryptography is a Rocky 10-only situation (RLSA-2026:71658).

Every entry points to CVSS base scores per CVE, so if you'd rather prioritize before rebooting everything at once, the numbers are there to help.

SUSE Linux

SUSE shipped another round of security updates across openSUSE Leap 16.0, Leap 15.5, and Tumbleweed, and the mix here is about what you'd expect: a pile of routine maintenance with a few things worth your actual attention.

Firefox is the one to grab first. The ESR branch jumped to 153.3.0 and cleared out 63 vulnerabilities, which is the number you'd normally see spread across several months of advisories. Use-after-free bugs, sandbox escapes, privilege escalations scattered across WebRender, CanvasWebGL, Service Workers, and just about every other subsystem. If you run Firefox on anything, install this before anything else.

The only critical rating in the batch goes to 389-ds, the LDAP directory server. Six vulnerabilities ride along, including an unauthenticated LDAP filter injection and a path that lets an unauthenticated attacker climb up to Directory Manager. The patch also pulls in a raft of non-security fixes (stack overflows, a PBKDF2 check, a rust dependency update). If you run LDAP, this is the one to apply before you go to bed.

The GIMP update quietly absorbed 11 fixes, several of them remote code execution bugs you'd trigger just by opening a maliciously crafted TIF, PSD, SGI, or ICO file. So there is now marginally safer way to load images, given the program's history. Worth a wince.

Beyond those three, the rest is mostly housekeeping. sdbootutil took a hit on eight vulnerabilities all rooted in the rust-openssl crate it wraps. kbd got a local privilege-escalation fix in openvt that was otherwise letting passwordless root login slip through. And Tumbleweed picked up a long tail of moderate updates, several of them just CVE references being added to fixes that were already in. One announcement is really just SUSE handing you a UEFI signing key that you'll need to import through the MOK dialog on your next boot, which is its own small chore.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y