Ubuntu kernel notices fix Arm TLB, i.MX, and SEV-SNP flaws

Ubuntu issued ten Linux kernel notices from 30 September to 6 October 2026 for CVE-2025-10263, CVE-2022-3114, CVE-2023-20585, and other flaws.

Between September 30 and October 6, 2026, Ubuntu published ten Linux kernel security notices for NVIDIA Tegra (USN-8849-1), AWS (USN-8817-3), FIPS (USN-8818-6), generic kernels (USN-8864-1, USN-8875-1, and USN-8887-1), Raspberry Pi (USN-8871-1), GCP (USN-8878-1), Oracle (USN-8879-1), and Azure (USN-8888-1). Six fix CVE-2025-10263, in which some Arm processors can finish a broadcast TLB invalidation before related memory writes are globally observed, so a local attacker might write memory after permissions were revoked; FIPS, Raspberry Pi, GCP, and Oracle explicitly say this may bypass protections or escalate privileges, while the Tegra and AWS notices describe the same impact as possible local privilege escalation. Those notices disagree on companion fixes: Tegra lists the NFS server and exFAT, FIPS and Raspberry Pi list the NFS client and exFAT, and AWS lists B.A.T.M.A.N. and HSR rather than NFS. USN-8864-1 separately fixes CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221 in the NFS server daemon, IPv6, and Netfilter, which Ubuntu says an attacker could possibly use to compromise a system. USN-8875-1, USN-8878-1, and USN-8879-1 fix CVE-2022-3114, a null-pointer dereference in the i.MX clock driver usable for a local crash; only USN-8875-1 says a memory-allocation failure can trigger it and also covers UAPI, several CPU architectures, User-Mode Linux, the block layer, and the cryptographic API, while GCP and Oracle also include CVE-2025-10263. USN-8887-1 and USN-8888-1 fix CVE-2023-20585, in which AMD processors failed proper Reverse Map Table checks when the IOMMU accessed certain host buffers, so a local attacker with hypervisor access could cause an out-of-bounds condition and compromise SEV-SNP guest memory integrity; USN-8888-1 also names ARM64, ARM32, MIPS, OpenRISC, PowerPC, RISC-V, NVDIMM, and the Handshake API, and unlike USN-8887-1 it does not discuss exploitation, while notices that do address it say exploitation is not reported or not observed.