Story · 1 source · 11 articlesfirst Sep 21, 13:04 UTCupdated Sep 25, 11:35 UTC (1d ago)

Ubuntu issues ten kernel notices citing Arm TLB flaw

highAdvisoryimportance 60CVE-2025-10263 CVE-2025-54518 CVE-2026-52938 CVE-2026-53325 CVE-2026-53361

What's new: These reports add IBM notice USN-8726-3 (21 September), which also cites CVE-2025-10263 and patches ARM64, UAPI, and the kernel build system, so the first IBM fix is earlier than only USN-8818-2 on 25 September. They do not include the previously summarized Low Latency notice USN-8729-4.

Merged summary · grok-4.7 · rewritten as coverage arrives

Ubuntu issued ten Linux kernel notices from 21 to 25 September 2026; six cite Arm TLB flaw CVE-2025-10263, and Azure USN-8728-2 also cites AMD Zen 2 CVE-2025-54518.

Between 21 and 25 September 2026, Ubuntu published ten Linux kernel security notices for generic, Azure, IBM, NVIDIA, and Oracle builds. The flaw named most often is CVE-2025-10263, in USN-8726-3, USN-8726-4, USN-8728-2, USN-8817-1, USN-8818-1, and USN-8818-2: on some Arm processors a broadcast TLB invalidation can complete before memory writes made through the invalidated translation are globally observed, letting a local attacker write memory after permission was revoked and possibly bypass protections or escalate privileges. Azure notice USN-8728-2 also names CVE-2025-54518, incomplete isolation of shared resources in the operation cache on some AMD Zen 2 processors that may allow local privilege escalation, and refers to further unnamed issues. Four notices—USN-8761-3, USN-8729-3, USN-8760-2, and USN-8802-1—list no CVE identifiers; three say an attacker could possibly compromise a system, while USN-8761-3 only describes the subsystems fixed. Patches touch ARM32, ARM64, PowerPC, RISC-V, S390, and x86; compute acceleration, Bluetooth, GPU, InfiniBand, network including Microsoft Azure MANA, SCSI, and SPI; cryptographic APIs, ACPI, EFI, Netfilter, UAPI, and the kernel build system; NTFS3, SMB, exFAT, and the NFS client; and TCM, B.A.T.M.A.N., and HSR. The notices do not contradict one another: USN-8726-3 describes the Arm issue more briefly as a TLB-invalidation memory-protection bypass, and none reports exploitation in the wild.

Ten Ubuntu Linux kernel notices, 21–25 September 2026: generic USN-8729-3 (21 Sep), USN-8726-4 (22 Sep), USN-8817-1 and USN-8818-1 (24 Sep); Azure USN-8761-3 (21 Sep) and USN-8728-2 (22 Sep); IBM USN-8726-3 (21 Sep) and USN-8818-2 (25…
CVE-2025-10263 is named in six notices (USN-8726-3, USN-8726-4, USN-8728-2, USN-8817-1, USN-8818-1, USN-8818-2): on some Arm processors a broadcast TLB invalidation can finish before related memory writes are globally observed, so a local…
Azure USN-8728-2 also names CVE-2025-54518, incomplete isolation of shared resources in the operation cache on some AMD Zen 2 processors that may allow local privilege escalation, plus further unnamed kernel issues.
USN-8761-3, USN-8729-3, USN-8760-2, and USN-8802-1 list no CVE identifiers; the last three say an attacker could possibly compromise a system, while USN-8761-3 only describes corrected flaws.
Fixes span ARM32, ARM64, PowerPC, RISC-V, S390, and x86; compute acceleration, Bluetooth, GPU, InfiniBand, network (including Microsoft Azure MANA), SCSI, and SPI; crypto APIs, ACPI, EFI, Netfilter, UAPI, and the kernel build system;…

VendorsCanonical Ubuntu Arm AMD NVIDIA

ProductsUbuntu Linux kernel Linux Kernel Azure

MalwareLinux kernel (IBM)

OrganizationsCanonical Ubuntu IBM Oracle Microsoft Azure

CountriesArm

AI modelsLinux kernel

Coverage timelineoldest first · each row is one article

Sep 21, 13:04 UTC · 5d ago
Ubuntu Security Notices· 45
USN-8761-3: Linux kernel (Azure) vulnerabilities
Ubuntu patches Linux kernel vulnerabilities affecting Azure VMs across ARM, GPU, network, and file system subsystems.
Sep 21, 13:04 UTC · 5d ago
Ubuntu Security Notices· 60
USN-8729-3: Linux kernel vulnerabilities
Ubuntu patches multiple Linux kernel vulnerabilities affecting ARM, GPU, network drivers, and file systems.
Sep 21, 13:04 UTC · 5d ago
Ubuntu Security Notices· 25
USN-8726-3: Linux kernel (IBM) vulnerabilities
Ubuntu kernel update patches a privilege escalation flaw (CVE-2025-10263) in Arm processors affecting IBM systems.

Vulnerabilities in this storyAll →

CVE-2025-102639.1<1%
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &…
published Jun 9, 2026
CVE-2025-545187.3<1%
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a…

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2025-10263	Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &… Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level. NVD description · AI analysis pending	9.1	<1%	—	—	Jun 9, 2026
CVE-2025-54518	Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a… Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation. NVD description · AI analysis pending	7.3	<1%	—	—	May 15, 2026
CVE-2026-52938	Linux kernel: bpf In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get(). NVD description · AI analysis pending	5.5	<1%	linux linux kernel	—	Jun 24, 2026
CVE-2026-53325	Linux kernel: agp/amd64 In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source. NVD description · AI analysis pending	5.5	<1%	linux linux kernel	—	Jun 29, 2026
CVE-2026-53361	Linux kernel: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with… In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) \|- gc_in_progress = true \| `- queue_work() \| unix_gc() <----------------/ \| \| \|- gc_in_progress = true ... `- queue_work() \| \| `- gc_in_progress = false \| \| unix_gc() <---------------------------------------------' \| ... /* gc_in_progress == false */ \| `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc(). NVD description · AI analysis pending	7.1	<1%	linux linux kernel	—	Jul 4, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-10263

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &…

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

NVD description · AI analysis pending

9.1

<1%

—

Jun 9, 2026

CVE-2025-54518

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a…

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

NVD description · AI analysis pending

7.3

<1%

—

May 15, 2026

CVE-2026-52938

Linux kernel: bpf

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().

NVD description · AI analysis pending

5.5

<1%

linux linux kernel

—

Jun 24, 2026

CVE-2026-53325

Linux kernel: agp/amd64

In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.

NVD description · AI analysis pending

5.5

<1%

linux linux kernel

—

Jun 29, 2026

CVE-2026-53361

Linux kernel: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().

NVD description · AI analysis pending

7.1

<1%

linux linux kernel

—

Jul 4, 2026