USN-8801-1: Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN-8801-1 patches Linux kernel flaws for Azure CVM images, including an Arm TLB invalidation privilege escalation bug.
Ubuntu issued USN-8801-1 correcting several Linux kernel vulnerabilities affecting Azure Confidential VM images. CVE-2025-10263 stems from some Arm processors completing broadcast TLB invalidation before memory writes through the invalidated translation were globally observed, letting a local attacker bypass memory protections or escalate privileges. Additional fixes address flaws in the character device driver, networking core, IPv6, and Unix domain socket subsystems (CVE-2026-52938, CVE-2026-53325, CVE-2026-53361).
- USN-8801-1 targets Linux kernel for Azure Confidential VM images
- CVE-2025-10263 allows local privilege escalation on affected Arm processors
- Fixes cover character device, networking core, IPv6, and Unix domain sockets
- Organizations
- UbuntuMicrosoft Azure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10263 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… | 9.1 | <1% | ||
| CVE-2026-52938 | Linux kernel: bpf | 5.5 | <1% | ||
| CVE-2026-53325 | Linux kernel: agp/amd64 | 5.5 | <1% | ||
| CVE-2026-53361 | Linux kernel: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with… | 7.1 | <1% |
From the original article
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.