SUSE is leading a massive wave of security patches across its distribution, most notably addressing 327 vulnerabilities within the Chromium browser codebase and resolving critical OpenSSL and Active Directory injection flaws. Ubuntu is pushing a heavy round of updates for its LTS lines, with WebKitGTK receiving fixes for 47 distinct CVEs spanning remote code execution and denial of service, alongside significant overhauls for MySQL, OpenJDK, and libssh2. Enterprise distributions like Red Hat, AlmaLinux, and Rocky Linux are addressing high-severity issues in libxml2 and iperf3, while Debian and Fedora are focusing on memory safety warts in expat, libarchive, and curl. Users on any current Linux track should clear their maintenance windows immediately, as many of these patches require a full system reboot to take effect.

Linux Security Update Roundup: SUSE Patches 327 Chromium Vulnerabilities, Ubuntu Pushes Major WebKit Fix

If you are running any current Linux distribution right now, you need to clear out your maintenance window. The headline is SUSE's decision to patch 327 CVEs across Chromium and its associated drivers, a move that suggests the browser codebase is showing structural fatigue. Ubuntu is close behind with a heavy round of patches for WebKitGTK, MySQL, and OpenJDK affecting multiple LTS lines.

Between SUSE, Ubuntu, and the major enterprise distributions, the patch queue is long. You will want to check your specific release track before running a blanket upgrade, as several advisories target older ELS streams alongside current releases.

The Big Hits: SUSE, Ubuntu, and the Browser Family

SUSE is leading the charge with a coordinated push that touches OpenSSL, PostgreSQL, and the Chromium ecosystem. The Chromium advisory is the one to watch. SUSE flagged www-client/chromium as vulnerable below 135.0.7049.95, affecting everything from ANGLE to WebRTC. The browser codebase is clearly showing structural fatigue, with use-after-free conditions and sandbox escape vectors showing up in everything from the renderer to the PDF viewer.

You will need to bump each browser to the current repository version and let upstream handle the fixes. No workaround exists. Gentoo issued a similar advisory with the same cutoff numbers for Chrome, Edge, and Opera.

Ubuntu's WebKitGTK update is equally significant. The fix covers 47 CVEs spanning cross-site scripting, remote code execution, and denial of service. If your browser or desktop uses it, you should apply this one first. The advisory explicitly lists CVE-2026-28847 through CVE-2026-64787 as the primary issues.

OpenSSL also took a coordinated hit across multiple SUSE version branches. The patches address heap overflows in CMS key unwrapping and unbounded cache growth in the CMP server. If you use YaST to join machines to Active Directory, pay attention to the new yast2-samba-client and yast2-auth-client releases. They close out OS command injection flaws that let attacker-controlled Organizational Unit strings slip straight into shell commands.

Red Hat is matching the severity on its enterprise tracks. RHEL 8 and 9 got updates for iperf3, libxml2, and mingw-sqlite. The iperf3 update lands on the Important list because the server happily accepts unlimited peer-controlled JSON parameters. A remote attacker can throttle your resources into submission.

AlmaLinux and Rocky Linux followed Red Hat's lead with four and eight security errata respectively. The libxml2 patch takes the center stage for AlmaLinux, fixing a buffer overflow that lets the xmlcatalog utility run arbitrary code. That same flaw shows up on both release tracks. The Rocky Linux update splits cleanly by version, with nodejs:24 and nodejs:22 getting their own dedicated rolls.

Debian's Long Term Support team rolled out patches for four C and Perl libraries. If you are running expat, you are looking at thirteen CVEs that mostly target integer overflows and callback reentrancy issues. libarchive picked up three fixes covering double-frees in RAR5 parsing, while librabbitmq gets two patches for out-of-bounds reads. The memory safety issues here are the same old warts you see in every other C library, but the sheer number of CVEs means you should probably apply these updates before the weekend.

Fedora landed a fresh security sweep across Fedora 43 and 44. The biggest headline is curl, which just absorbed six separate CVEs covering everything from SSH verification bypasses to use-after-free bugs in socket callbacks. BIND is in a similar spot with eight patches for cache poisoning and DNSSEC validation flaws. The Linux kernel lands a single upstream patch for CVE-2026-80590, though Fedora chose to tag the whole kernel series as a security update since upstream will assign additional CVEs after the packages ship.

The rest of the batch is a mix of upstream bumps and targeted hardening. Python pip got a path traversal fix, gdk-pixbuf patched an out-of-bounds read in the ICO parser, and epiphany added ZIP slip handling for WebExtension extraction.

The Updates in Detail

AlmaLinux

AlmaLinux rolled out four security errata for versions 8 and 9. The libxml2 library takes the center stage, patched for a buffer overflow that lets the xmlcatalog utility run arbitrary code. That same flaw shows up on both release tracks, while the AlmaLinux 9 build picked up an additional use-after-free bug that triggers denial of service on malformed XML. iperf3 landed on the Important list because the server happily accepts unlimited peer-controlled JSON parameters, which means a remote attacker can throttle your resources into submission. The mingw-sqlite package also got flagged Important after researchers discovered a path to trigger arbitrary code execution through specially crafted FTS5 full-text search data. If you run either flavor of AlmaLinux, applying these patches is the obvious move. The libxml2 and iperf3 flaws affect server and desktop environments equally, and the SQLite issue matters most if your Windows cross-compilation toolchain actually ingests untrusted search indexes.

Debian GNU/Linux

Debian's Long Term Support team rolled out security patches for four C and Perl libraries. If you are running expat, you are looking at thirteen CVEs that mostly target integer overflows and callback reentrancy issues, which tend to produce use-after-free bugs in XML parsers. libarchive picked up three fixes covering double-frees in RAR5 parsing, heap overflows in tar PAX headers, and a ZIP encryption size overflow that could let a malicious archive writer escape its sandbox. librabbitmq gets two patches for out-of-bounds reads and heap writes, while libdbi-perl rounds out the main advisory with nine vulnerabilities. That batch includes arbitrary code execution via the DBI_PROFILE environment variable and a symlink escape in the file backend. A separate advisory addresses a regression in libdbd-csv-perl where the previous DBI fix broke the test suite. The memory safety issues here are the same old warts you see in every other C library, but the sheer number of CVEs means you should probably apply these updates before the weekend.

Fedora Linux

Fedora rolled out a fresh security sweep, patching vulnerabilities across both Fedora 43 and 44. The biggest headline is curl, which just absorbed six separate CVEs covering everything from SSH verification bypasses to use-after-free bugs in socket callbacks. BIND is in a similar spot with eight patches for cache poisoning, DNSSEC validation flaws, and unexpected exits. If your workflow touches SSH tooling, you are getting fixes for a cluster of golang.org/x/crypto/ssh weaknesses and IP spoofing bugs in bundled routing libraries like chi and go-chi. The Linux kernel lands a single upstream patch for CVE-2026-80590, and Fedora chose to tag the whole kernel series as a security update since upstream will assign additional CVEs after the packages ship. The rest of the batch is a mix of upstream bumps and targeted hardening, including a path traversal fix in Python pip, an out-of-bounds read in gdk-pixbuf, ZIP slip handling in epiphany, and privilege escalation mitigations in kbd. Run dnf upgrade to pull everything down.

Gentoo Linux

Gentoo issued GLSA 202608-34 flagging 25 tracked vulnerabilities across the entire Chromium-derivative browser family. If you are running any version of Chromium, Google Chrome, Microsoft Edge, or Opera below the cutoff numbers listed below, your installation is sitting on a patchwork of issues dating back to 2024. Gentoo is not maintaining downstream patches here, which means you just need to bump each browser to the current repository version and let upstream handle the fixes. No workaround exists, and the advisory ships with direct emerge commands for those who want to force an immediate upgrade. Sync your Portage tree and push the updates through your normal maintenance window.

Red Hat Enterprise Linux

Red Hat shipped another round of security errata this cycle, and if your environment spans RHEL 7 through 10, your patch queue just grew by roughly half a hundred advisories. The batch leans heavily on "Important" ratings, with a smattering of "Moderate" fixes and a single "Low" severity entry. NetworkManager, pipewire, iperf3, libXfont2, libreswan, xmlrpc-c, and the various Node.js streams hit multiple channels at once, which is about as common as it gets in Red Hat's release cadence. xmlrpc-c alone shows up four times across different EUS and SAP streams. You'll want to cross-reference your actual stream before running a blanket update, especially if you're still on Extended Lifecycle Support or running SAP/Telecom services. The MicroShift entry is the only one calling out a full platform release rather than a single package bump.

Rocky Linux

Rocky Linux just shipped eight updates across its two supported release trains. If you are running either Rocky Linux 8 or 9, your patch manager has a solid evening ahead. The batch splits cleanly by version, with libxml2 and Node.js getting their own dedicated rolls for each release. Most of these land at Important severity, which typically means upstream closed something that could actually be exploited. The pipewire and libxml2 patches sit at Moderate, and the PHP update is rated Low. The official descriptions keep mentioning CVSS scores and CVE references, so if you want the raw numbers behind the severity labels, you will need to chase down the individual CVEs yourself. The errata links point straight to Rocky's standard tracking system, so expect the usual routine: pull the update, verify your dependencies, and move on.

SUSE Linux

SUSE just pushed out a massive batch of security patches, and if you are running any of their current SLE or openSUSE stacks, you will want to get them applied. The obvious headline is Chromium and its bundled driver, both taking hits for 327 vulnerabilities. The browser codebase clearly has some structural fatigue, with use-after-free conditions and sandbox escape vectors showing up in everything from ANGLE to WebRTC. OpenSSL took a coordinated hit across multiple version branches, patching heap overflows in CMS key unwrapping and unbounded cache growth in the CMP server. If you use YaST to join machines to Active Directory, pay attention to the new yast2-samba-client and yast2-auth-client releases. They close out OS command injection flaws that let attacker-controlled Organizational Unit strings slip straight into shell commands. PostgreSQL received the same overhaul across versions 14, 15, 17, and 18, with 24 to 28 fixes per release covering heap overflows, SQL injection via expression deparsing, and privilege escalation paths. Unbound and Dovecot picked up cache poisoning and authentication bypass patches, while Tumbleweed and Leap 16.0 saw updates roll through Istio, JupyterLab, and Python cryptography libraries. You will probably have at least half of these queued up in your maintenance window, so running them before the weekend is the move.

Ubuntu Linux

Ubuntu just pushed a heavy security batch for its LTS lines for nearly every major service you run. WebKitGTK took the biggest hit, patching 47 CVEs that cover cross-site scripting, remote code execution, and denial of service. If your browser or desktop uses it, you will want to apply this one first. MySQL also gets a massive overhaul. Ubuntu 26.04 moves straight to 8.4.11, while 22.04 and 24.04 receive backported patches for 29 separate vulnerabilities.

If you are running Java, you will want to update across the board. OpenJDK 26 and the Coordinated Restore at Checkpoints (CRaC) variants for JDKs 17, 21, and 25 all share the exact same nine-vulnerability list, mostly tied to JSSE authentication bypasses and component authorization flaws. The OpenSSL notice is actually a follow-up (USN-8678-3) to patch a missing fix for CVE-2026-75803 from an earlier advisory, so do not skip it if you updated OpenSSL recently. util-linux takes the next biggest hit with seven CVEs spanning heap use-after-free bugs to TOCTOU privilege escalation. libssh follows with nine issues, including an AES-GCM tag verification flaw that could let a man-in-the-middle tweak encrypted traffic unnoticed.

System utilities like cpio, attr, and diffutils round out the list with the usual symlink and buffer overflow headaches. bzip2, Perl, and p11-kit patch memory management and regex issues across older LTS lines. Meanwhile, Ubuntu 26.04.1 LTS has officially dropped. The ISO refresh swaps in disk encryption PIN skip fixes and standard security updates. A normal apt upgrade will catch most of these, though packages like UDisks2, OpenZFS, and OpenSSL will require a system reboot to take effect.

How to apply these Linux security updates

Before running any update commands, check which services are currently active on your system. If Nginx or Apache is handling live traffic, schedule a brief maintenance window or use rolling restarts to minimize downtime during the patching process. Desktop users can usually apply these fixes by opening a terminal and running the standard package manager command for their distribution followed by an upgrade flag. A reboot will be necessary if the kernel received updates to ensure the new security modules load correctly.

Power users who rely on command-line tools like jq should verify the patch level after installation. Regression bugs can occasionally break scripts that depend on specific JSON parsing behavior, so a quick test run is worth the few minutes it takes. If you use PackageKit or other GUI package managers and prefer to skip them because they sometimes hang or try to install junk, do not let that stop you from running the command-line equivalent to get these critical patches applied.

Applying these patches requires distribution-specific package management commands. RHEL-based systems typically use dnf update or yum update, while Debian and Ubuntu rely on apt upgrade. SUSE users should run zypper patch to properly address all security advisories, and Slackware administrators can manage updates with upgradepkg or slackpkg. After executing the commands, a reboot is usually necessary for kernel changes to take effect. Finally, review your package manager’s logs to verify that all patches installed successfully and no dependencies were disrupted.

Debian/Ubuntu (apt)

The first thing to do is refresh the local package index; running sudo apt update contacts all configured repositories and pulls in the newest lists of available versions. Skipping this step leaves the system blind to any recent uploads, which explains why “upgrade” sometimes claims there’s nothing to do even after a security advisory has been published. Once the index is current, invoke sudo apt upgrade -y; the -y flag answers every prompt automatically so the process doesn’t pause for user input. This command upgrades all installed packages that have newer versions in the repositories while preserving configuration files.

sudo apt update
sudo apt upgrade -y

Fedora/RedHat/Rocky/Alma/Oracle (dnf or yum)

On modern Fedora and recent Red Hat derivatives, dnf is the package manager; older RHEL releases still rely on yum. Begin with a check‑update operation—sudo dnf check-update or sudo yum check-update—to see exactly which packages are awaiting an upgrade. This preview step can be useful for spotting unexpected kernel bumps before they land. To actually apply the updates, run sudo dnf upgrade -y (or sudo yum update if you prefer the older tool). The upgrade command pulls down the new binaries and runs any necessary post‑install scripts, such as rebuilding initramfs when a kernel changes.

sudo dnf check-update
sudo dnf upgrade -y

or on older releases

sudo yum check-update
sudo yum update

SUSE (zypper)

SUSE’s command line front‑end is called zypper. First execute sudo zypper refresh so that the metadata for all enabled repos gets updated; without this, zypper will happily report “No updates available” even though newer packages sit on the mirror. After a fresh refresh, issue sudo zypper update -y; this upgrades every package to the latest version in the configured repositories and automatically handles service restarts when required.

sudo zypper refresh
sudo zypper update -y

Gentoo Linux

Updating Gentoo Linux is more involved than binary distributions because it's a source-based system with highly customizable packages.

sudo emerge --sync
sudo emerge -avuDN @world