Story · 2 sources · 14 articlesfirst Sep 24, 15:00 UTCupdated Sep 29, 09:19 UTC (19h ago)

Ubuntu kernel notices fix Arm TLB flaw and other bugs

highAdvisoryimportance 52CVE-2025-10263 CVE-2025-38724 CVE-2026-53131 CVE-2026-53221 CVE-2025-54518

What's new: These ten reports were already incorporated in the previous summary; the 29 September follow-ups USN-8818-3 and USN-8819-3 repeat the same CVE-2025-10263 and NFS, IPv6, and Netfilter fixes without new identifiers, exploitation, or impact details.

Merged summary · grok-4.7 · rewritten as coverage arrives

From 24–29 September 2026 Ubuntu patched Linux kernel flaws including an Arm TLB privilege-escalation bug, while Canada urged updates to multiple kernel branches.

Between 24 and 29 September 2026 Ubuntu published nine Linux kernel security notices. USN-8816-1 patches flaws across ARM64, S390, and x86 plus drivers and filesystems including DRBD, InfiniBand, NVMe, MANA, Virtio Host, Xen, NFS, NTFS3, and OCFS2, but names no CVEs. CVE-2025-10263, an Arm broadcast TLB invalidation race that can let a local attacker write memory after permission was revoked and possibly escalate privileges, is fixed in USN-8817-1 and in USN-8818-1, USN-8818-2 (IBM), and USN-8818-3; USN-8817-1 also lists B.A.T.M.A.N. and HSR, while the 8818 series lists exFAT and the NFS client. USN-8819-1, USN-8819-2, and USN-8819-3 fix NFS server, IPv6, and Netfilter flaws CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221, and USN-8729-5 updates the AWS FIPS kernel without listing CVE IDs. Canada's AV26-970 (28 September 2026) separately says stable kernels before 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, and 7.2.6, plus kernels before 4.7, need updates, but names no CVE, so these reports do not tie it to a specific Ubuntu notice. None of the sources report exploitation in the wild; stated impact ranges from local privilege escalation for CVE-2025-10263 to possible system compromise.

Between 2026-09-24 and 2026-09-29 Ubuntu published nine Linux kernel notices: USN-8816-1, USN-8817-1, USN-8818-1, USN-8818-2 (IBM), USN-8818-3, USN-8819-1, USN-8819-2, USN-8819-3, and USN-8729-5 (AWS FIPS).
CVE-2025-10263 is an Arm broadcast TLB invalidation race: on some Arm processors invalidation can finish before related writes are globally visible, letting a local attacker write memory after permission was revoked, bypass protections,…
CVE-2025-10263 is addressed in USN-8817-1 and USN-8818-1/-2/-3; USN-8817-1 also covers ARM64, InfiniBand, network drivers, TCM, B.A.T.M.A.N., and HSR, while the 8818 series also covers ARM64, InfiniBand, network drivers, TCM, exFAT, and…
USN-8819-1, USN-8819-2, and USN-8819-3 fix NFS server, IPv6, and Netfilter flaws tracked as CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221; Ubuntu says an attacker could possibly compromise a system.
USN-8816-1 (ARM64, S390, x86, DRBD, InfiniBand, NVMe, MANA, Virtio Host, Xen, NFS, NTFS3, OCFS2) and USN-8729-5 (ARM, PowerPC, Bluetooth, GPU, InfiniBand, network drivers, Microsoft Azure Network Adapter, SCSI, NTFS3, SMB) list no CVE…
On 2026-09-28 the Canadian Centre for Cyber Security issued AV26-970, saying kernels before 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, and 7.2.6, plus kernels before 4.7, need updates; it names no CVE and describes no impact.

VendorsUbuntu Arm Canonical

ProductsLinux kernel Ubuntu Linux Kernel

OrganizationsCanonical Ubuntu IBM Canadian Centre for Cyber Security Intel Linux Oracle AMD Arm

CountriesCanada

Coverage timelineoldest first · each row is one article

Sep 24, 15:00 UTC · 5d ago
Ubuntu Security Notices· 32
USN-8816-1: Linux kernel vulnerabilities
Ubuntu patched multiple Linux kernel flaws across architectures, drivers, and filesystems that could allow system compromise.
Sep 24, 15:01 UTC · 5d ago
Ubuntu Security Notices· 52
USN-8817-1: Linux kernel vulnerabilities
Ubuntu USN-8817-1 fixes Linux kernel bugs, including an Arm TLB flaw that may enable local privilege escalation.
Sep 24, 15:02 UTC · 5d ago
Ubuntu Security Notices· 52
USN-8818-1: Linux kernel vulnerabilities
Ubuntu kernel update fixes an Arm TLB race that may allow local privilege escalation, plus other driver and filesystem flaws.

Vulnerabilities in this storyAll →

CVE-2025-102639.1<1%
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &…
published Jun 9, 2026
CVE-2025-387247.8<1%
Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that…

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2025-10263	Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level. NVD description · AI analysis pending	9.1	<1%	—	—	Jun 9, 2026
CVE-2025-38724	Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that… In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked(). NVD description · AI analysis pending	7.8	<1%	linux linux kernel linux debian linux	—	Sep 4, 2025
CVE-2025-54518	Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a… Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation. NVD description · AI analysis pending	7.3	<1%	—	—	May 15, 2026
CVE-2026-53221 +1 related CVE CVE-2026-53131	Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address. NVD description · AI analysis pending	9.8 group max	<1%	linux linux kernel	—	Jun 25, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-10263

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &…

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

NVD description · AI analysis pending

9.1

<1%

—

Jun 9, 2026

CVE-2025-38724

Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that…

In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().

NVD description · AI analysis pending

7.8

<1%

linux linux kernel
linux debian linux

—

Sep 4, 2025

CVE-2025-54518

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a…

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

NVD description · AI analysis pending

7.3

<1%

—

May 15, 2026

CVE-2026-53221

+1 related CVE

CVE-2026-53131

Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

NVD description · AI analysis pending

9.8

group max

<1%

linux linux kernel

—

Jun 25, 2026