Ubuntu kernel notices cover Arm TLB, i.MX crash, and AMD SEV-SNP flaws
Newer notices extend CVE-2025-10263 fixes to Raspberry Pi, GCP, and Oracle kernels and add CVE-2022-3114 on generic, Azure CVM, GCP, and Oracle packages, USN-8864-1’s NFS, IPv6, and Netfilter flaws (CVE-2025-38724, CVE-2026-53131, CVE-2026-53221), and AMD SEV-SNP issue CVE-2023-20585 in USN-8887-1 and Azure USN-8888-1. None report exploitation.
From 30 September to 6 October 2026, Ubuntu kernel notices fixed CVE-2025-10263, CVE-2022-3114, CVE-2023-20585, and NFS, IPv6, and Netfilter flaws, with no exploitation reported.
Between 30 September and 6 October 2026, Ubuntu published ten Linux kernel security notices for AWS, FIPS, generic, Raspberry Pi, Azure confidential VM, GCP, Oracle, and Azure images. CVE-2025-10263, in which some Arm processors can finish a broadcast TLB invalidation before related memory writes are globally visible, is fixed for AWS (USN-8817-3), FIPS (USN-8818-6), Raspberry Pi (USN-8871-1), GCP (USN-8878-1), and Oracle (USN-8879-1); the notices agree a local attacker might then write memory after permissions were revoked and escalate privileges or bypass protections. Accompanying fixes name ARM64, InfiniBand and network drivers, and TCM, while AWS instead lists B.A.T.M.A.N. and HSR and the FIPS and Raspberry Pi notices list exFAT and the NFS client. CVE-2022-3114, an i.MX clock-driver null-pointer dereference that a local attacker can use to crash the system, appears in USN-8875-1, Azure CVM USN-8876-1, and the GCP and Oracle notices; USN-8875-1 also covers UAPI, several architectures, User-Mode Linux, the block layer, and the cryptographic API. Separately, USN-8864-1 addresses NFS server, IPv6, and Netfilter issues CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221, and USN-8887-1 plus Azure USN-8888-1 fix AMD SEV-SNP flaw CVE-2023-20585. The notices do not contradict one another on shared CVEs and none report active exploitation, though only some explicitly say exploitation was not observed.
- On 30 September 2026, USN-8817-3 updated Ubuntu’s AWS Linux kernel for CVE-2025-10263 and flaws in ARM64, InfiniBand and network drivers, TCM, B.A.T.M.A.N., and HSR.
- On 2 October 2026, USN-8818-6 patched the FIPS kernel for CVE-2025-10263 plus ARM64, InfiniBand, networking, TCM, exFAT, and the NFS client.
- The same day, USN-8864-1 fixed NFS server, IPv6, and Netfilter flaws CVE-2025-38724, CVE-2026-53131, and CVE-2026-53221; Ubuntu said an attacker could possibly compromise a system.
- On 5 October 2026, USN-8871-1 applied the CVE-2025-10263 fix, plus ARM64, InfiniBand, network, TCM, exFAT, and NFS client fixes, to Raspberry Pi kernels.
- CVE-2025-10263 is an Arm TLB race: a broadcast invalidation can finish before related writes are globally visible, which a local attacker might use to write memory after access was revoked and escalate privileges.
- On 6 October 2026, CVE-2022-3114, a local i.MX clock-driver null-pointer crash (including after a memory-allocation failure), was fixed in USN-8875-1, Azure CVM USN-8876-1, GCP USN-8878-1, and Oracle USN-8879-1; GCP and Oracle also fix…
- Also on 6 October, USN-8887-1 and Azure USN-8888-1 fixed CVE-2023-20585, where failed AMD Reverse Map Table checks can let a local hypervisor attacker cause an out-of-bounds condition and compromise SEV-SNP guest memory.
- None of the ten notices report active exploitation.
- Organizations
- UbuntuAmazon Web ServicesCanonicalOracleGoogle
Coverage
oldest first · one row per article · UTC- · Sep 30, 2026
Ubuntu Security NoticesFirst report
USN-8818-5: Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu patched NVIDIA Tegra kernel flaws, including an Arm TLB bug that may enable local privilege escalation.
- · Sep 30, 2026
USN-8817-3: Linux kernel (AWS) vulnerabilities
Ubuntu patched AWS Linux kernel flaws, including an Arm TLB bug that may allow local privilege escalation.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-3114 | An issue was discovered in the Linux kernel through 5.16-rc6 | 5.5 | <1% | ||
| CVE-2023-20585 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds… | 5.6 | <1% | ||
| CVE-2025-10263 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… | 9.1 | <1% | ||
| CVE-2025-38724 | Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that… | 7.8 | <1% | ||
CVE-2026-53221+1 related CVE | Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 group max | <1% |