Linux gives you a computer you control. You choose the distribution, nothing forces you to sign in to a vendor account, and anyone can read the source code. What it doesn’t give you is a system that’s safe on its own, and its weak spots differ from the ones on Windows or macOS.
This page is about desktop and laptop Linux: distributions such as Ubuntu, Fedora and Debian that you install on a computer. Android, ChromeOS and Qubes OS also use the Linux kernel but work differently, and we don’t cover them. Facts about versions and dates are as of October 2026.
After reading you’ll know what protects a Linux desktop by default and what doesn’t. You’ll also know which four choices change your risk most: how you get updates, where you get software, whether the disk is encrypted, and how apps are confined.
What Linux is in plain terms
Strictly, Linux is the kernel, the core program that talks to your hardware. A distribution bundles that kernel with a desktop, a package manager (the tool that installs and updates software) and a set of default choices. When people say they run Linux, they mean a distribution, and the distribution decides most of your security.
Take two people who both say they run Linux. One installed Ubuntu 26.04 LTS, released in April 2026, and takes software from repositories the distribution maintains. The other runs Arch Linux and installs apps from the Arch User Repository (AUR), a collection of install recipes that anyone can submit. In June 2026, more than 400 of those recipes were found modified to install a rootkit and a credential-stealing program. The two people have the same kernel and very different exposure.
How Linux security works
Accounts, and no wall between your apps
Linux keeps users apart and puts system files behind an administrator (root) password. By default it doesn’t separate the programs you run as yourself from each other. A program started from your account can read what your account can read: your documents, your browser profile, your SSH keys. Flatpak’s own design notes describe isolating applications from one another as one of its main goals, which tells you where the default stands. Most of the protections below exist to add walls where this model has none.
Updates come from your distribution
Software arrives through your distribution’s package manager, and the distribution decides how long each release is maintained. Ubuntu LTS releases get five years of standard security maintenance, and Ubuntu 26.04 LTS is covered until May 2031. Ubuntu Pro, a subscription, extends coverage to May 2036. Other distributions publish their own dates. Check yours first, because a release past its end date stops receiving fixes.
The kernel gets a lot of fixes. The kernel team became its own CVE Numbering Authority (the body that issues CVE vulnerability IDs) in February 2024, and its policy is to assign a CVE to almost any bug fix that might matter for security. Kernel developer Greg Kroah-Hartman wrote in December 2025 that the project had gone from number 3 among CVE issuers in 2024 to number 1 in 2025, and it had assigned its 10,000th CVE by late 2025. Read that as a measure of how much gets fixed, not as proof that Linux is worse than other systems. It does mean updates arrive often, and you need to install them.
Firmware updates for laptops and desktops usually come through fwupd and the Linux Vendor Firmware Service (LVFS). Not every hardware vendor publishes there, which matters for the Secure Boot change below.
Confinement: access control, Flatpak and snaps
Mandatory access control is a set of kernel-enforced rules that limit what a program can touch even when it runs as you. Fedora uses SELinux by default, and Ubuntu and Debian use AppArmor. Ubuntu says per-app permission prompting for snap packages is still experimental and not on by default in 26.04 LTS, so don’t assume these frameworks fence in every app you run.
Flatpak and snap run apps in sandboxes. Flatpak’s documentation describes the default sandbox as having no access to processes outside it and no access to host services such as X11, the system D-Bus or PulseAudio. But each app’s manifest can ask for that access, and Flatpak’s lead developer has noted that an installed app gets the permissions it requested unless you override them. A Flatpak app with access to your whole home folder or to X11 is much less contained than the label suggests. The sandbox is only as strong as the permissions the app asks for.
Display server: X11 and Wayland
The display server draws windows and routes your keyboard and mouse. Under X11, the long-standing design, Flatpak’s lead developer wrote in 2017 that you can easily use the protocol to do lots of malicious things, and other writers describe keylogging under X11 as trivial. Wayland, its replacement, is built so that apps see input only for their own windows. As of October 2026, Ubuntu 26.04 LTS ships a Wayland-only default GNOME session. Wayland doesn’t limit what a malicious program running as you can do to your files, so it complements sandboxing and doesn’t replace it.
Secure Boot and the 2026 certificate change
Secure Boot makes a computer’s firmware refuse to start boot code that isn’t signed by a trusted key. On most PCs, Linux starts through a small program called shim. Microsoft signs shim, and shim then loads the distribution’s own bootloader and kernel, which the distribution signs itself.
The Microsoft certificate that signs shim (Microsoft UEFI CA 2011) expired on 26 or 27 June 2026. Its replacement is valid until 2038. LWN reported on 1 July 2026 that systems which already boot will keep booting, because firmware generally ignores expiry dates. A system can fail to boot if its firmware lacks the 2023 certificate and it then receives a new shim signed only with it. Firmware updates delivered through fwupd and LVFS can add the new certificate. The article’s author, who works on the transition at Microsoft, also warns that forced updates have left some machines unbootable, a few permanently. For most people on a maintained distribution and maintained hardware, the distribution handles this. The machines at risk are those whose vendor has stopped publishing firmware updates.
Disk encryption
Full-disk encryption protects your data if a laptop is lost or stolen while powered off. It does nothing against malware on a running, unlocked system. Ubuntu 26.04 LTS made TPM-backed full-disk encryption a supported feature. The key is held by the computer’s security chip instead of being typed at boot. Canonical says it improved recovery-key handling around firmware updates and documents some known incompatibilities. With automatic unlocking, no disk passphrase stands between a thief and your login screen, so your login password carries more weight. One third-party guide says a startup PIN can be set after installation.
Immutable distributions
Some distributions, such as Fedora Silverblue, keep the core system files read-only. Fedora Magazine describes this as stopping you from changing core files arbitrarily, with desktop apps installed through Flatpak and traditional package installs confined to containers. Updates apply as a whole and can be rolled back. The trade-off is a different way of working: some familiar steps, like installing a system package, no longer behave the way older guides describe.
What it protects against, and what it doesn’t
| Threat | What helps | Where it falls short |
|---|---|---|
| Thief with a powered-off laptop | Full-disk encryption | Doesn’t help on a running, unlocked machine. Automatic unlocking leans on your login password |
| Malicious software from a community repository | Official repositories, Flatpak or snap sandboxes | Anyone can submit AUR recipes. Sandboxes can be given broad permissions |
| Tampered upstream software (xz, 2024) | Stable releases, prompt updates | The backdoor reached testing and rolling releases of several distributions before it was found |
| Another app capturing your keystrokes | A Wayland session, sandboxing | Doesn’t contain a malicious program running as you |
| Tampering with the boot process | Secure Boot | The 2026 certificate change can break boot on hardware that doesn’t get firmware updates |
Two limits sit outside the table. Open-source code can be read by anyone, but that doesn’t mean anyone has checked it. And you’re trusting your distribution’s maintainers and the packages they ship, the same way you’d trust a vendor elsewhere.
Common myths
“Linux doesn’t get malware.” It does. In June 2026, attackers modified more than 400 AUR packages to download a malicious npm package that installed a rootkit and an infostealer. Arch disabled AUR package adoption on 30 July 2026 after a second wave of malicious commits to orphaned packages. Early reports of the June count vary, and one later account puts it above 1,500.
“Open source means someone has checked it.” The xz backdoor (CVE-2024-3094) shows the gap. An actor spent about two years gaining maintainer status in the xz compression project, then slipped a hidden backdoor into versions 5.6.0 and 5.6.1 that could have allowed remote access through SSH. Engineer Andres Freund discovered it in March 2024. It reached development and rolling releases of Fedora, Debian, Kali and openSUSE, and Kaspersky said it had found no cases of exploitation. It was caught, which is good. Nobody planned to catch it.
“A Flatpak or snap is sandboxed, so it’s safe.” Only as far as its permissions go. An app that asks for your home folder can read your home folder.
What to do
- Pick a supported release and turn on automatic updates. Look up your distribution’s end-of-support date, and set updates to install on their own. This covers the threat that affects the most people, and it’s the cheapest step.
- Be strict about where software comes from. Use your distribution’s official repositories first, then Flatpak or snap. Treat community repositories like the AUR and scripts piped from the web as code written by strangers. The 2024 and 2026 incidents both came through that kind of channel.
- Encrypt the disk during installation. It’s easiest to choose at install time. Store the recovery key somewhere other than the laptop, and decide whether you want a startup PIN or automatic unlocking.
- Keep firmware updated and Secure Boot on. Enable fwupd or your distribution’s firmware updater, and read your distribution’s notes before big upgrades, because of the 2026 certificate change. If your vendor has stopped issuing firmware updates, expect more friction and plan for it.
- Check app permissions and prefer a Wayland session. For Flatpak apps, look at what each one asks for and override broad access like the whole home folder where the app still works without it.
- Consider an immutable distribution if you want rollback. It suits people who mostly use a browser and desktop apps, and it fits less well if you rely on installing system packages.
If you’re unsure how much of this matters for you, start with threat modeling. For how Linux compares with a phone operating system, see the iOS overview.
What this page doesn’t cover
We haven’t covered Linux servers and containers, privacy-focused systems such as Tails, Whonix and Qubes OS, kernel and boot-parameter hardening, privacy tweaks such as MAC address randomization, or hardware and gaming compatibility. We also haven’t compared individual distributions. Each deserves its own page.
Sources
- Linux CVEs, more than you ever wanted to know. Greg Kroah-Hartman, Linux Kernel Monkey Log, December 2025.
- Kernel CNA statistics post (10,000th CVE). Greg Kroah-Hartman, social.kernel.org, 2025.
- Linux Kernel Project Becomes CVE Numbering Authority. ADMIN Magazine, February 2024.
- Secure Boot certificate expiration is here. Brian Exelbierd, LWN.net, 1 July 2026.
- What’s new in security for Ubuntu 26.04 LTS?. Canonical, 10 April 2026.
- Ubuntu release cycle. Canonical, 2026.
- Ubuntu 26.04 LTS: Best New Features. DebugPoint, 2026.
- Ubuntu 26.04 LTS Resolute Raccoon: A Complete Guide to What’s New. Serverspace, 2026.
- Sandbox Permissions. Flatpak documentation, undated.
- The flatpak security model, part 2: Who needs sandboxing anyway?. Alexander Larsson, GNOME Blogs, 2017.
- GNOME 50: Wayland-Only Brings Enhanced Security and Isolation. LinuxSecurity.com, undated.
- AppArmor vs. SELinux: Comprehensive Comparison. phoenixNAP, undated.
- Fedora Silverblue, an introduction for developers. Fedora Magazine, undated.
- How to find systems impacted by CVE-2024-3094 (XZ Utils). runZero, 2024.
- Malicious code discovered in Linux distributions. Kaspersky, 2024.
- Malicious maintainer introduces sophisticated backdoor in xz. CNCF TAG Security, 2024.
- Over 400 Arch Linux packages compromised to push rootkit, infostealer. BleepingComputer, 12 June 2026.
- Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes. Hexnode, 3 August 2026.
- How to Use the AUR Safely: Lessons from the June 2026 AUR Malware Attack. OSTechNix, 2026.