Ubuntu issues ten kernel notices citing Arm TLB flaw

Ubuntu issued ten Linux kernel notices from 21 to 25 September 2026; six cite Arm TLB flaw CVE-2025-10263, and Azure USN-8728-2 also cites AMD Zen 2 CVE-2025-54518.

Between 21 and 25 September 2026, Ubuntu published ten Linux kernel security notices for generic, Azure, IBM, NVIDIA, and Oracle builds. The flaw named most often is CVE-2025-10263, in USN-8726-3, USN-8726-4, USN-8728-2, USN-8817-1, USN-8818-1, and USN-8818-2: on some Arm processors a broadcast TLB invalidation can complete before memory writes made through the invalidated translation are globally observed, letting a local attacker write memory after permission was revoked and possibly bypass protections or escalate privileges. Azure notice USN-8728-2 also names CVE-2025-54518, incomplete isolation of shared resources in the operation cache on some AMD Zen 2 processors that may allow local privilege escalation, and refers to further unnamed issues. Four notices—USN-8761-3, USN-8729-3, USN-8760-2, and USN-8802-1—list no CVE identifiers; three say an attacker could possibly compromise a system, while USN-8761-3 only describes the subsystems fixed. Patches touch ARM32, ARM64, PowerPC, RISC-V, S390, and x86; compute acceleration, Bluetooth, GPU, InfiniBand, network including Microsoft Azure MANA, SCSI, and SPI; cryptographic APIs, ACPI, EFI, Netfilter, UAPI, and the kernel build system; NTFS3, SMB, exFAT, and the NFS client; and TCM, B.A.T.M.A.N., and HSR. The notices do not contradict one another: USN-8726-3 describes the Arm issue more briefly as a TLB-invalidation memory-protection bypass, and none reports exploitation in the wild.