Ubuntu patches multiple Linux kernel flaws across five notices
First coverage.
Ubuntu issued five kernel notices in October 2026, naming CVEs for crashes, SEV-SNP integrity, and PID leaks, with no reported exploitation.
Ubuntu issued five Linux kernel security notices between 2026-10-09 and 2026-10-13 covering generic, GCP, and NVIDIA kernel packages. USN-8905-2 and USN-8903-2 fix issues across ARM, ARM64, MIPS, and x86 code and drivers such as GPU, HID, networking, InfiniBand, Intel NPU, Mellanox, and the Microsoft Azure Network Adapter; both excerpts omit CVE IDs and describe only possible system compromise. USN-8875-2 names CVE-2022-3114, a local null-pointer dereference in the i.MX clock driver that can crash the system, and also patches other architectural and subsystem flaws. USN-8887-3 names CVE-2023-20585, in which a local attacker with hypervisor access could affect the integrity of AMD SEV-SNP guest memory, and covers further architecture and NVDIMM fixes. USN-8924-1 addresses older issues: CVE-2017-5967 can leak a real PID from a PID namespace, while CVE-2018-13093 and a separate f2fs metadata flaw can crash the system via malicious filesystem images. No notice reports exploitation in the wild, and the sources do not conflict; they describe different notices with different levels of CVE detail.
- On 2026-10-09 Ubuntu published USN-8905-2 (GCP kernel), USN-8903-2 (Linux kernel), USN-8875-2 (NVIDIA kernel), and USN-8887-3 (Linux kernel); USN-8924-1 followed on 2026-10-13.
- USN-8905-2 and USN-8903-2 patch architectural code (ARM, ARM64, MIPS, x86) and drivers including GPU, HID, networking, InfiniBand, Intel NPU, Mellanox, and Microsoft Azure Network Adapter; excerpts list no CVE IDs.
- Ubuntu says those two notices address flaws an attacker could possibly use to compromise a system; neither reports in-the-wild exploitation.
- USN-8875-2 includes CVE-2022-3114, a null-pointer dereference in the i.MX clock driver when a memory allocation fails, which a local attacker could use to crash the system.
- USN-8887-3 includes CVE-2023-20585, an AMD IOMMU Reverse Map Table check flaw; a local attacker with hypervisor access could trigger an out-of-bounds condition and compromise SEV-SNP guest memory integrity.
- USN-8924-1 covers CVE-2017-5967 (timer stats can reveal a real PID from inside a PID namespace) and CVE-2018-13093 (malicious XFS image can crash the system when mounted), plus an f2fs metadata-validation crash via a crafted image.
- None of the five notices report active exploitation.
- Products
- Linux kernelSEV-SNPUbuntuXFSf2fs
- Organizations
- CanonicalGoogle Cloud
Coverage
oldest first · one row per article · UTC- · 21d ago
Ubuntu Security NoticesFirst report
USN-8905-2: Linux kernel (GCP) vulnerabilities
Ubuntu patched GCP Linux kernel vulnerabilities that could allow an attacker to compromise the system.
- · 21d ago
USN-8903-2: Linux kernel vulnerabilities
Ubuntu patched multiple Linux kernel flaws that could let an attacker compromise the system.
- · 21d ago
USN-8875-2: Linux kernel (NVIDIA) vulnerabilities
Ubuntu fixed NVIDIA Linux kernel flaws, including local crash bug CVE-2022-3114.
- · 21d ago
USN-8887-3: Linux kernel vulnerabilities
Ubuntu patched Linux kernel flaws, including AMD SEV-SNP issue CVE-2023-20585.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5967 | The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from… | 4.0 | <1% | ||
| CVE-2018-13093 | An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3 | 5.5 | 2% | ||
| CVE-2022-3114 | An issue was discovered in the Linux kernel through 5.16-rc6 | 5.5 | <1% | ||
| CVE-2023-20585 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds… | 5.6 | <1% |