Ubuntu issues 10 kernel security notices in a week, patching Arm TLB race, AMD Zen 2 cache flaw, and NFS/IPv6/Netfilter bugs
Nothing new since the previous summary of 29 September 2026. All ten notices (USN-8728-2 through USN-8819-3, published 22–29 September 2026) were already in scope, the same five CVE identifiers remain the complete set, and no additional USNs, CVEs, or reports of exploitation in the wild have been added. This story is a re-merge of the same report set with no substantive changes.
Between 22 and 29 September 2026 Canonical published 10 Ubuntu Security Notices for Linux kernel builds including Azure, Oracle, IBM, and generic kernels, patching CVE-2025-10263 (Arm broadcast TLB invalidation race), CVE-2025-54518 (AMD Zen 2 operation-cache…
Between 22 and 29 September 2026, Canonical published ten Ubuntu Security Notices covering Linux kernel packages for Azure (USN-8728-2), Oracle (USN-8802-1), IBM (USN-8818-2), and generic or follow-on builds (USN-8816-1, USN-8817-1, USN-8818-1, USN-8818-3, USN-8819-1, USN-8819-2, USN-8819-3). Ubuntu repeatedly states that an attacker could possibly use the flaws to compromise a system, and none of the notices reports exploitation in the wild. CVE-2025-10263, named in USN-8728-2 and in USN-8817-1 and the USN-8818 series, is a race in which some Arm processors can complete a broadcast TLB invalidation before related memory writes are globally observed, allowing a local attacker to write memory after permissions were revoked, bypass protections, or escalate privileges. Only USN-8728-2 also names CVE-2025-54518, an incomplete isolation of shared resources in the operation cache on some AMD Zen 2 processors that may allow local privilege escalation. The USN-8819 series (notices 1 through 3) cites CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221 for flaws in the NFS server daemon, IPv6 networking, and Netfilter. USN-8802-1 (Oracle) and USN-8816-1 describe broad subsystem coverage without naming CVE identifiers in the provided text: USN-8802-1 lists ARM32, ARM64, PowerPC, drivers, EFI, GPU, InfiniBand, networking including Microsoft Azure MANA, SCSI, SPI, NTFS3, and SMB, while USN-8816-1 lists ARM64, S390, x86, and filesystems and drivers including DRBD, InfiniBand, NVMe, MANA, Virtio Host, Xen, NFS, NTFS3, and OCFS2. USN-8817-1 additionally covers ARM64, InfiniBand and network drivers, TCM, B.A.T.M.A.N. meshing, and the HSR protocol; USN-8818-1, -2, and -3 also cover ARM64, InfiniBand and network drivers, TCM, exFAT, and the NFS client. The notices do not contradict one another on impact; they differ only in which CVEs and subsystems each kernel build names.
- 10 notices published 22–29 September 2026: USN-8728-2 (Azure) and USN-8802-1 (Oracle) on 22 Sep; USN-8816-1, USN-8817-1, USN-8818-1, USN-8819-1 on 24 Sep; USN-8818-2 (IBM) and USN-8819-2 on 25 Sep; USN-8818-3 and USN-8819-3 on 29 Sep.
- Five unique CVE identifiers appear across the set: CVE-2025-10263, CVE-2025-54518, CVE-2025-38724, CVE-2026-53131, CVE-2026-53221.
- CVE-2025-10263 is named in USN-8728-2, USN-8817-1, USN-8818-1, USN-8818-2, and USN-8818-3; on some Arm processors a broadcast TLB invalidation can complete before related memory writes are globally observed, so a local attacker might write…
- CVE-2025-54518 is named only in USN-8728-2 (Azure): incomplete isolation of shared resources in the operation cache on some AMD Zen 2 processors may allow local privilege escalation.
- USN-8819-1, USN-8819-2, and USN-8819-3 all cite CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221 for flaws in the NFS server daemon, IPv6 networking, and Netfilter.
- USN-8802-1 (Oracle) and USN-8816-1 name no CVE identifiers in the provided text; their fixes span ARM32/ARM64/PowerPC/S390/x86, drivers, EFI, GPU, InfiniBand, NVMe, MANA, Virtio Host, Xen, SCSI, SPI, DRBD, NFS, NTFS3, exFAT-related areas,…
- Ubuntu states an attacker could possibly use the issues to compromise a system in USN-8802-1, USN-8816-1, and the USN-8819 series.
- No notice reports exploitation in the wild, and the notices do not contradict one another on impact; they differ only in which CVEs and subsystems each kernel build names.
Coverage
oldest first · one row per article · UTC- · Sep 22, 2026
Ubuntu Security NoticesFirst report
USN-8729-4: Linux kernel (Low Latency) vulnerabilities
Ubuntu fixes multiple Low Latency Linux kernel flaws across architectures, drivers, and filesystems.
- · Sep 22, 2026
USN-8730-5: Linux kernel vulnerability
Ubuntu patches a Linux kernel flaw affecting IPv6 networking and Netfilter that could compromise systems.
- · Sep 22, 2026
USN-8726-4: Linux kernel vulnerabilities
Ubuntu's USN-8726-4 fixes Linux kernel flaws, including an Arm TLB issue enabling possible local privilege escalation.
- · Sep 22, 2026
USN-8728-2: Linux kernel (Azure) vulnerabilities
Ubuntu patches Azure Linux kernel flaws, including local privilege-escalation issues on Arm and AMD Zen 2.
- · Sep 22, 2026
USN-8802-1: Linux kernel (Oracle) vulnerabilities
Ubuntu USN-8802-1 patches multiple Oracle-flavor Linux kernel flaws that could compromise systems.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10263 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… | 9.1 | <1% | ||
| CVE-2025-38724 | Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that… | 7.8 | <1% | ||
| CVE-2025-54518 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a… | 7.3 | <1% | ||
CVE-2026-53221+1 related CVE | Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 group max | <1% |