Ubuntu Security Notices
USN-8917-1

USN-8917-1: Linux kernel vulnerabilities

Publication date

13 October 2026

Overview

Several security issues were fixed in the Linux kernel.

Releases

24.04 LTS

Packages

linux - Linux kernel
linux-aws - Linux kernel for Amazon Web Services (AWS) systems
linux-aws-fips - Linux kernel for Amazon Web Services (AWS) systems with FIPS
linux-fips - Linux kernel with FIPS
linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
linux-gcp-fips - Linux kernel for Google Cloud Platform (GCP) systems with FIPS
linux-gke - Linux kernel for Google Container Engine (GKE) systems
linux-gkeop - Linux kernel for Google Container Engine (GKE) systems
linux-ibm - Linux kernel for IBM cloud systems
linux-lowlatency - Linux low latency kernel
linux-oracle - Linux kernel for Oracle Cloud systems
linux-realtime - Linux kernel for Real-time systems

Details

It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

NVDIMM (Non-Volatile Memory Device) drivers;
Handshake API;
ARM32 architecture;
ARM64 architecture;
MIPS architecture;
PowerPC architecture;
RISC-V architecture;
S390 architecture;
x86 architecture;
Block layer subsystem;
Cryptographic API;
Intel NPU Driver;
ACPI drivers;
Android...

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

NVDIMM (Non-Volatile Memory Device) drivers;
Handshake API;
ARM32 architecture;
ARM64 architecture;
MIPS architecture;
PowerPC architecture;
RISC-V architecture;
S390 architecture;
x86 architecture;
Block layer subsystem;
Cryptographic API;
Intel NPU Driver;
ACPI drivers;
Android drivers;
Serial ATA and Parallel ATA drivers;
Drivers core;
DRBD Distributed Replicated Block Device drivers;
Rados block device (RBD) driver;
Bluetooth drivers;
Cdrom driver;
Character device driver;
Hardware random number generator core;
TPM device driver;
Data acquisition framework and drivers;
CPU frequency scaling framework;
Hardware crypto device drivers;
DAX dirext access to differentiated memory framework;
Buffer Sharing and Synchronization framework;
DMA engine subsystem;
FireWire subsystem;
Arm Firmware Framework for ARMv8-A(FFA);
ARM SCMI message protocol;
Intel Stratix 10 firmware drivers;
FPGA Framework;
GPIO subsystem;
GPU drivers;
HID subsystem;
Microsoft Hyper-V drivers;
Hardware monitoring drivers;
CoreSight HW tracing drivers;
Intel Trace Hub HW tracing drivers;
I2C subsystem;
IIO subsystem;
IIO ADC drivers;
IIO Magnetometer sensors drivers;
InfiniBand drivers;
Input Device core drivers;
Input Device (Miscellaneous) drivers;
Input Device (Mouse) drivers;
IOMMU subsystem;
IRQ chip drivers;
LED subsystem;
Mailbox framework;
Multiple devices driver;
Media drivers;
MemoryStick subsystem;
Multifunction device drivers;
Intel Management Engine Interface driver;
Amazon Nitro Secure Module driver;
MMC subsystem;
MTD block device drivers;
Network drivers;
Ethernet bonding driver;
Mellanox network drivers;
Microsoft Azure Network Adapter (MANA) driver;
MediaTek network drivers;
NTB driver;
NVME drivers;
PCI subsystem;
x86 platform drivers;
i.MX PM domains;
System reset/shutdown drivers;
Power supply drivers;
RapidIO drivers;
Voltage and Current Regulator drivers;
Remote Processor subsystem;
Reset controller framework;
RPMSG subsystem;
Real Time Clock drivers;
S/390 drivers;
SCSI subsystem;
Xilinx SoC drivers;
SPI subsystem;
Media staging drivers;
Media Oriented Systems Transport (MOST) driver;
NVIDIA Tegra embedded controller (NVEC) staging driver;
Realtek RTL8723BS SDIO drivers;
VME bus staging drivers;
TCM subsystem;
TTY drivers;
USB DSL drivers;
Cadence USB3 driver;
ULPI bus;
USB core drivers;
DesignWare USB3 driver;
Faraday FOTG210 USB2 dual-role controller driver;
USB Gadget drivers;
USB Host Controller drivers;
USB ChaosKey driver;
Siemens ID Mouse USB driver;
IOWarrior USB driver;
LD Didactic USB driver;
LEGO USB Tower driver;
USS720 USB parallel port adapter driver;
MediaTek USB3 DRD driver;
USB Dual Role (OTG-ready) Controller drivers;
USB Serial drivers;
USB Type-C Port Controller Manager driver;
USB Type-C Connector System Software Interface driver;
USB over IP driver;
vDPA drivers;
VFIO drivers;
Virtio Host (VHOST) subsystem;
Framebuffer layer;
Watchdog drivers;
Xen hypervisor drivers;
9P distributed file system;
AFS file system;
File systems infrastructure;
BTRFS file system;
Ceph distributed file system;
exFAT file system;
Ext4 file system;
F2FS file system;
FUSE (File system in Userspace);
GFS2 file system;
HFS file system;
HFS+ file system;
Journaling layer for block devices (JBD2);
Network file system (NFS) client;
Network file system (NFS) server daemon;
NILFS2 file system;
NTFS3 file system;
OCFS2 file system;
OrangeFS file system;
Proc file system;
SMB network file system;
UDF file system;
XFS file system;
Key management;
BPF subsystem;
Memory management;
File system encryption (fscrypt);
Software nodes and device properties;
Glob pattern matching library;
IPv4 networking;
KVM subsystem;
Mellanox drivers;
Socket messages infrastructure;
Sun RPC protocol;
Memory Management;
Media input infrastructure;
IPv6 networking;
Bluetooth subsystem;
Wireless networking;
Networking core;
IP tunnels definitions;
Netfilter;
SCTP protocol;
Network sockets;
Network traffic control;
XFRM subsystem;
io_uring subsystem;
Audit subsystem;
Control group (cgroup);
Kernel CPU control infrastructure;
Perf events;
Kernel exit() syscall;
Kernel fork() syscall;
Locking primitives;
Kernel module support;
Scheduler infrastructure;
Signal handling mechanism;
Timer subsystem;
Tracing infrastructure;
Debug objects infrastructure;
6LoWPAN network protocol;
9P file system network protocol;
Asynchronous Transfer Mode (ATM) subsystem;
B.A.T.M.A.N. meshing protocol;
Ethernet bridge;
CAN network layer;
Ceph Core library;
HSR network protocol;
IEEE802154.4 network protocol;
IFE protocol;
IUCV driver;
KCM (Kernel Connection Multiplexor) sockets driver;
Logical Link layer;
MAC80211 subsystem;
IEEE 802.15.4 subsystem;
MultiProtocol Label Switching driver;
Open vSwitch;
Packet sockets;
Phonet protocol;
Packet sampling (psample);
Qualcomm IPC Router (QRTR);
RDS protocol;
RxRPC session sockets;
SMC sockets;
TIPC protocol;
TLS protocol;
Unix domain sockets;
VMware vSockets driver;
X.25 network layer;
AppArmor security module;
Linux Security Modules (LSM) Framework;
Integrity Measurement Architecture(IMA) framework;
SELinux security module;
Apple Onboard Audio ALSA driver;
ALSA framework;
FireWire sound drivers;
HD-audio driver;
Gravis UltraSound ALSA driver;
C-Media CMI8x38 ALSA driver;
ESS Solo-1 ALSA driver;
ICE1712/ICE1724 (Envy24) ALSA driver;
Yamaha YMFPCI ALSA driver;
Texas InstrumentS Audio (ASoC/HDA) drivers;
SoC Audio for Freescale CPUs drivers;
MediaTek ASoC drivers;
QCOM ASoC drivers;
SOF drivers;
NVIDIA Tegra ASoC drivers;
USB sound devices

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
24.04 LTS noble	linux-image-6.8.0-1052-gkeop – 6.8.0-1052.56
	linux-image-6.8.0-1064-oracle – 6.8.0-1064.67
	linux-image-6.8.0-1064-oracle-64k – 6.8.0-1064.67
	linux-image-6.8.0-1066-gke – 6.8.0-1066.74
	linux-image-6.8.0-1066-gke-64k – 6.8.0-1066.74
	linux-image-6.8.0-1067-aws – 6.8.0-1067.70
	linux-image-6.8.0-1067-aws-64k – 6.8.0-1067.70
	linux-image-6.8.0-1067-aws-fips – 6.8.0-1067.70+fips1
	linux-image-6.8.0-1067-ibm – 6.8.0-1067.68
	linux-image-6.8.0-1071-gcp – 6.8.0-1071.79
	linux-image-6.8.0-1071-gcp-64k – 6.8.0-1071.79
	linux-image-6.8.0-1071-gcp-fips – 6.8.0-1071.79+fips1
	linux-image-6.8.0-147-fips – 6.8.0-147.147+fips1
	linux-image-6.8.0-147-generic – 6.8.0-147.147
	linux-image-6.8.0-147-generic-64k – 6.8.0-147.147
	linux-image-6.8.0-147-lowlatency – 6.8.0-147.147.1
	linux-image-6.8.0-147-lowlatency-64k – 6.8.0-147.147.1
	linux-image-6.8.1-1062-realtime – 6.8.1-1062.63
	linux-image-aws-6.8 – 6.8.0-1067.70
	linux-image-aws-64k-6.8 – 6.8.0-1067.70
	linux-image-aws-64k-lts-24.04 – 6.8.0-1067.70
	linux-image-aws-fips – 6.8.0-1067.70+fips1
	linux-image-aws-fips-6.8 – 6.8.0-1067.70+fips1
	linux-image-aws-lts-24.04 – 6.8.0-1067.70
	linux-image-fips – 6.8.0-147.147+fips1
	linux-image-fips-6.8 – 6.8.0-147.147+fips1
	linux-image-gcp-6.8 – 6.8.0-1071.79
	linux-image-gcp-64k-6.8 – 6.8.0-1071.79
	linux-image-gcp-64k-lts-24.04 – 6.8.0-1071.79
	linux-image-gcp-fips – 6.8.0-1071.79+fips1
	linux-image-gcp-fips-6.8 – 6.8.0-1071.79+fips1
	linux-image-gcp-lts-24.04 – 6.8.0-1071.79
	linux-image-generic – 6.8.0-147.147
	linux-image-generic-6.8 – 6.8.0-147.147
	linux-image-generic-64k – 6.8.0-147.147
	linux-image-generic-64k-6.8 – 6.8.0-147.147
	linux-image-generic-lpae – 6.8.0-147.147
	linux-image-gke – 6.8.0-1066.74
	linux-image-gke-6.8 – 6.8.0-1066.74
	linux-image-gke-64k – 6.8.0-1066.74
	linux-image-gke-64k-6.8 – 6.8.0-1066.74
	linux-image-gkeop – 6.8.0-1052.56
	linux-image-gkeop-6.8 – 6.8.0-1052.56
	linux-image-ibm – 6.8.0-1067.68
	linux-image-ibm-6.8 – 6.8.0-1067.68
	linux-image-ibm-classic – 6.8.0-1067.68
	linux-image-ibm-lts-24.04 – 6.8.0-1067.68
	linux-image-intel-iot-realtime – 6.8.1-1062.63
	linux-image-intel-iotg – 6.8.0-147.147
	linux-image-kvm – 6.8.0-147.147
	linux-image-laptop-23.10 – 6.8.0-147.147
	linux-image-lowlatency – 6.8.0-147.147.1
	linux-image-lowlatency-6.8 – 6.8.0-147.147.1
	linux-image-lowlatency-64k – 6.8.0-147.147.1
	linux-image-lowlatency-64k-6.8 – 6.8.0-147.147.1
	linux-image-oracle-6.8 – 6.8.0-1064.67
	linux-image-oracle-64k-6.8 – 6.8.0-1064.67
	linux-image-oracle-64k-lts-24.04 – 6.8.0-1064.67
	linux-image-oracle-lts-24.04 – 6.8.0-1064.67
	linux-image-realtime – 6.8.1-1062.63
	linux-image-realtime-6.8.1 – 6.8.1-1062.63
	linux-image-virtual – 6.8.0-147.147
	linux-image-virtual-6.8 – 6.8.0-147.147