Story · 1 source · 18 articlesfirst Oct 2, 06:30 UTCupdated Oct 8, 12:56 UTC (11h ago)

Ubuntu October kernel notices cover cloud, Pi, and IBM

mediumAdvisoryimportance 38CVE-2025-10263 CVE-2023-20585 CVE-2022-3114 CVE-2025-38724 CVE-2026-53131 CVE-2026-53221

What's new: Reports dated 8 October 2026 add AWS notice USN-8887-2 and Azure follow-up USN-8888-2 for CVE-2023-20585, plus IBM notice USN-8906-1 for CVE-2025-10263; none reports exploitation. The 2–6 October notices were already covered.

Merged summary · grok-4.7 · rewritten as coverage arrives

Through 8 October 2026 Ubuntu patched multiple Linux kernels for Arm TLB, i.MX, AMD SEV-SNP, and networking flaws, with no exploitation reported.

Between 2 and 8 October 2026 Ubuntu published Linux kernel security notices for generic, Raspberry Pi, GCP, Oracle, Azure, AWS, and IBM packages. USN-8864-1 addresses CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221 in the NFS server, IPv6, and Netfilter, which Ubuntu says an attacker could possibly use to compromise a system. CVE-2025-10263, an Arm TLB invalidation issue that may let a local attacker write memory after permissions were revoked and escalate privileges, is cited for Raspberry Pi (USN-8871-1), GCP (USN-8878-1), Oracle (USN-8879-1), and IBM (USN-8906-1). CVE-2022-3114, a local i.MX clock-driver null-pointer crash, is named in USN-8875-1 and the GCP and Oracle notices, while CVE-2023-20585, an AMD RMP and IOMMU flaw affecting SEV-SNP guest memory integrity for a local attacker with hypervisor access, is covered by USN-8887-1, Azure USN-8888-1, AWS USN-8887-2, and Azure USN-8888-2. Additional architecture, driver, and filesystem fixes differ by kernel flavor; the notices do not contradict one another and none reports active exploitation.

From 2 to 8 October 2026 Ubuntu issued kernel notices USN-8864-1, USN-8871-1 (Raspberry Pi), USN-8875-1, USN-8878-1 (GCP), USN-8879-1 (Oracle), USN-8887-1, USN-8888-1 (Azure), USN-8887-2 (AWS), USN-8888-2 (Azure), and USN-8906-1 (IBM).
USN-8864-1 fixes CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221 in the NFS server, IPv6, and Netfilter; Ubuntu says an attacker could possibly compromise a system.
CVE-2025-10263, an Arm broadcast TLB invalidation bug a local attacker might use to write memory after permissions were revoked and possibly escalate privileges, is named for Raspberry Pi, GCP, Oracle, and IBM.
CVE-2022-3114, a local null-pointer crash in the i.MX clock driver, including after a memory-allocation failure per USN-8875-1, is named in USN-8875-1, GCP, and Oracle notices.
CVE-2023-20585, flawed AMD Reverse Map Table checks on IOMMU access that a local hypervisor attacker could use to affect SEV-SNP guest memory integrity, is covered by USN-8887-1, USN-8888-1, AWS USN-8887-2, and Azure USN-8888-2.
Other fixes, varying by notice, span ARM/ARM64/ARM32, MIPS, PowerPC, RISC-V, OpenRISC, x86, InfiniBand and network drivers, TCM, exFAT, NFS client, UAPI, User-Mode Linux, the block layer, crypto API, NVDIMM, Handshake API, and the Intel…
None of the notices reports exploitation in the wild.

VendorsCanonical IBM Ubuntu AMD Microsoft

ProductsLinux kernel SEV-SNP Ubuntu Raspberry Pi Azure CVM

OrganizationsUbuntu Canonical AMD Microsoft Amazon Web Services Oracle Google

Coverage timelineoldest first · each row is one article

Oct 2, 06:30 UTC · 6d ago
Ubuntu Security Notices· 32
USN-8851-2: Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu patched Raspberry Pi Linux kernel flaws in NFS, IPv6, and Netfilter that could compromise systems.
Oct 2, 07:04 UTC · 6d ago
Ubuntu Security Notices· 36
USN-8864-1: Linux kernel vulnerabilities
Ubuntu patched Linux kernel flaws in NFS, IPv6, and Netfilter that could let an attacker compromise the system.
Oct 5, 14:43 UTC · 3d ago
Ubuntu Security Notices· 26
USN-8851-3: Linux kernel (Azure) vulnerabilities
Ubuntu patched Linux kernel flaws in NFS, IPv6, and Netfilter for Azure kernels in USN-8851-3.

Vulnerabilities in this storyAll →

CVE-2022-31145.5<1%
An issue was discovered in the Linux kernel through 5.16-rc6
published Dec 14, 2022· linux linux kernel
CVE-2023-205855.6<1%
Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds…

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2022-3114	An issue was discovered in the Linux kernel through 5.16-rc6 An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference. NVD description · AI analysis pending	5.5	<1%	linux linux kernel	—	Dec 14, 2022
CVE-2023-20585	Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds… Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity. NVD description · AI analysis pending	5.6	<1%	—	—	Apr 16, 2026
CVE-2025-10263	Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level. NVD description · AI analysis pending	9.1	<1%	—	—	Jun 9, 2026
CVE-2025-38724	Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that… In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked(). NVD description · AI analysis pending	7.8	<1%	linux linux kernel linux debian linux	—	Sep 4, 2025
CVE-2026-53221 +1 related CVE CVE-2026-53131	Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address. NVD description · AI analysis pending	9.8 group max	<1%	linux linux kernel	—	Jun 25, 2026