Ubuntu publishes a batch of Linux kernel security notices
First merged summary.
On November 10–11, Ubuntu issued multiple kernel USNs for several flavors; snippets omit most fixed versions and any exploitation.
Ubuntu published a series of Linux kernel security notices on November 10 and 11 covering generic, AWS, Raspberry Pi and NVIDIA kernels. The notices describe separate issues, including Xen paravirtualization frontends, AX.25, an i.MX clock driver, a Turtle Beach audio race and io_uring, plus broader subsystem fixes. Ubuntu says an attacker could possibly use various flaws to compromise the system; described impacts also include local crashes and, for the audio race, possible code execution. The feed text does not give fixed package versions or say any flaw is being exploited.
- November 10 notices cover generic, AWS and Raspberry Pi kernels among others.
- USN-9033-1 and USN-9034-1 cover Xen frontends tracked as CVE-2022-23036 and CVE-2022-23037.
- USN-9029-1 lists AX.25 CVE-2022-1205 and i.MX clock CVE-2022-3114, both local crashes.
- USN-9035-1 says CVE-2017-9986 can crash the system or possibly run code locally.
- USN-9020-1 describes io_uring memory exhaustion CVE-2026-80811 and a hang, CVE-2026-81009.
- November 11 NVIDIA notices name IPv4 and network-driver issues; most snippets omit versions.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026Ubuntu publishes multiple Linux kernel security notices. · Ubuntu Security Notices
- Nov 11, 2026Ubuntu adds NVIDIA and NVIDIA BaseOS kernel notices. · Ubuntu Security Notices
What each outlet adds
beyond the shared facts- Ubuntu Security NoticesLists distinct USNs, flavors, subsystems and the CVEs named in each snippet.
- CVEs
- CVE-2025-21656CVE-2026-63940CVE-2026-74350CVE-2026-98432CVE-2026-99999CVE-2026-98239CVE-2022-23037CVE-2022-23036CVE-2026-80811CVE-2026-81009CVE-2017-9986CVE-2022-49114+4 more
- Organizations
- Ubuntu
Coverage
oldest first · one row per article · UTC- · 1d ago
Ubuntu Security NoticesFirst report
Ubuntu fixes multiple Linux kernel flaws in USN-9018-1
The notice says an attacker could possibly use the issues to compromise a system, without listing CVE ids.
- · 1d ago
Ubuntu kernel update addresses flaws that could compromise the system
USN-9027-1 covers x86, hardware monitoring, OCFS2, IPv4, Ethernet bridge, Netfilter and XFRM flaws.
- · 1d ago
Ubuntu fixes Linux kernel io_uring flaws enabling local denial of service
CVE-2026-80811 can exhaust memory and CVE-2026-81009 can hang the system; a third issue is only partly described.
- · 1d ago
Ubuntu kernel update covers USB, memory, networking and architectures
USN-9023-1 also names Intel NPU, block layer, ACPI, Android and multiple CPU architectures, with no CVEs in the snippet.
- · 1d ago
Ubuntu patches Linux kernel flaws, including Xen frontend bugs
CVE-2022-23036 and CVE-2022-23037 could let a malicious Xen backend read guest memory or crash the guest.
- · 1d ago
Ubuntu patches AWS Linux kernel flaws, including Xen frontend bug
A malicious Xen backend could read guest memory pages or crash the guest; other kernel subsystems are also fixed.
- · 1d ago
Ubuntu patches Raspberry Pi kernel flaws, including AX.25
Local attackers could crash the system via AX.25 use-after-free and an i.MX clock null-pointer flaw.
- · 1d ago
Ubuntu kernel update includes MultiSound driver CVE-2017-9986
A local attacker could crash the system or possibly run code via a Turtle Beach audio driver race.
- · 1d ago
Ubuntu patches multiple Linux kernel flaws in USN-9022-1
The update covers USB, networking, memory management, several CPU architectures and other kernel subsystems, with no exploitation stated.
- · 10h ago
Ubuntu patches Linux kernel (NVIDIA BaseOS) network flaws
The notice covers issues in network drivers and IPv4 networking tracked as CVE-2026-98239 and CVE-2026-98432.
- · 10h ago
Ubuntu fixes a Linux kernel (NVIDIA) IPv4 networking flaw
USN-9045-1 says the issue is in IPv4 networking and an attacker could possibly compromise the system.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-9986 | The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or… | 7.8 | <1% | ||
| CVE-2022-1205 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol | 4.7 | <1% | PoC | |
CVE-2022-23036+1 related CVE | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs | 7.0 | <1% | ||
| CVE-2022-3114 | An issue was discovered in the Linux kernel through 5.16-rc6 | 5.5 | <1% | ||
| CVE-2022-49114 | Linux kernel: scsi: libfc | 8.8 | <1% | ||
| CVE-2023-52784 | Linux kernel: bonding: stop the device in bond_setup_by_slave() | 5.5 | <1% | ||
| CVE-2024-53194 | Linux kernel: PCI | 7.8 | <1% | ||
| CVE-2025-21656 | Linux kernel: hwmon: (drivetemp) | 5.5 | <1% | ||
| CVE-2026-63940 | Linux kernel: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count… | 9.3 | <1% | ||
| CVE-2026-74350 | Linux kernel: ocfs2: validate fast symlink target during inode read ocfs2_validate_inode_block() already rejects several… | 9.8 | <1% | ||
| CVE-2026-80811 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | <1% | ||
| CVE-2026-81009 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | — | ||
| CVE-2026-98239 | Use-after-free in Linux kernel lan743x RX checksum | 8.1 | — | ||
CVE-2026-98432+1 related CVE | Use-after-free in Linux kernel IPv4 TCP options | 9.8 group max | <1% | PoC ×25 |