[LSN-0121-1] Linux kernel vulnerability

Benjamin Romer benjamin.romer at canonical.com
Thu Aug 27 13:43:15 UTC 2026 

Linux kernel vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 22.04 LTS

Summary

Several security issues were fixed in the kernel.

Software Description

- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke - Linux kernel for Google Container Engine (GKE) systems
- linux-ibm - Linux kernel for IBM cloud systems
- linux-oracle - Linux kernel for Oracle Cloud systems

Details

In the Linux kernel, the following vulnerability has been resolved:
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack. (CVE-2025-68263)

In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state. (CVE-2026-23428)

In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In
DecodeQ931(), the UserUserIE code path reads a 16-bit length from the
packet, then decrements it by 1 to skip the protocol discriminator byte
before passing it to DecodeH323_UserInformation(). (CVE-2026-23455)

In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay
cache uses a fixed 112-byte inline buffer (rp_ibuf. (CVE-2026-31402)

In the Linux kernel, the following vulnerability has been resolved:
media: dvb-net: fix OOB access in ULE extension header tables The
ule_mandatory_ext_handlers. (CVE-2026-31405)

It was discovered that the Linux kernel algif_aead module did not
properly handle in-place cryptographic operations. This flaw is known
as
Copy Fail. A local attacker could use this to escalate privileges, or
possibly escape a container. (CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved:
ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 “ksmbd: add
support for read compound”), response buffer management was changed to
use dynamic iov array. (CVE-2026-31478)

In the Linux kernel, the following vulnerability has been resolved:
usbip: validate number_of_packets in usbip_pack_ret_submit() When a
USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit()
unconditionally overwrites urb->number_of_packets from the network PDU.
This value is subsequently used as the loop bound in usbip_recv_iso()
and usbip_pad_iso() to iterate over urb->iso_frame_desc.
(CVE-2026-31607)

In the Linux kernel, the following vulnerability has been resolved:
rxrpc: reject undecryptable rxkad response tickets
rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then
parses the buffer as plaintext without checking whether
crypto_skcipher_decrypt() succeeded. (CVE-2026-31637)

In the Linux kernel, the following vulnerability has been resolved:
batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway’s last reference while readers still follow the pointer.
(CVE-2026-31657)

In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. (CVE-2026-31659)

In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after
writing each EA entry. (CVE-2026-31705)

In the Linux kernel, the following vulnerability has been resolved:
net/x25: Fix potential double free of skb When alloc_skb fails in
x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1
(error). (CVE-2026-43011)

In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb. (CVE-2026-43037)

In the Linux kernel, the following vulnerability has been resolved:
ipv6: icmp: clear skb2->cb. (CVE-2026-43038)

In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from
sp->max_recv_size and req->preferred_send_size to a signed int before
computing min_t(int, …). (CVE-2026-43185)

In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On
the
receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide
how much data to write for each node. (CVE-2026-43186)

In the Linux kernel, the following vulnerability has been resolved:
libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key,
verify that the key material would fit into a fixed-size buffer in
process_auth_done() and generally has a sane length. (CVE-2026-43304)

In the Linux kernel, the following vulnerability has been resolved:
net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace
length in a u8. (CVE-2026-43341)

In the Linux kernel, the following vulnerability has been resolved:
libceph: prevent potential out-of-bounds reads in
process_message_header() If the message frame is (maliciously)
corrupted
in a way that the length of the control segment ends up being less than
the size of the message header or a different frame is made to look
like
a message frame, out-of-bounds reads may ensue in
process_message_header(). Perform an explicit bounds check before
decoding the message header.. (CVE-2026-43406)

In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
This patch fixes an out-of-bounds access in ceph_handle_auth_reply()
that can be triggered by a message of type CEPH_MSG_AUTH_REPLY.
(CVE-2026-43407)

In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG
requests can return EBUSY. (CVE-2026-43493)

In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header,
swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back.
(CVE-2026-43501)

In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets
a
temporary failure during processing, it may end up in a partially
decrypted state - and then get requeued for a retry. (CVE-2026-45988)

In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
rxe_rcv() currently checks only that the incoming packet is at least
header_size(pkt) bytes long before payload_size() is used.
(CVE-2026-46043)

In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix slab-out-of-bounds access in auth message processing If a
(potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a
positive value in its result field, it is treated as an error code by
ceph_handle_auth_reply() and returned to handle_auth_reply().
(CVE-2026-46119)

In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: fix race between ICReq handling and queue teardown
nvmet_tcp_handle_icreq() updates queue->state after sending an
Initialization Connection Response (ICResp), but it does so without
serializing against target-side queue teardown. (CVE-2026-46135)

In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix out-of-bounds read in symlink_data() Since
smb2_check_message() returns success without length validation for the
symlink error response, in symlink_data() it is possible for
iov->iov_len to be smaller than sizeof(struct smb2_err_rsp).
(CVE-2026-46185)

In the Linux kernel, the following vulnerability has been resolved:
smb:
client: validate dacloffset before building DACL pointers
parse_sec_desc(), build_sec_desc(), and the chown path in
id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd
before proving a DACL header fits inside the returned security
descriptor. On 32-bit builds a malicious server can return dacloffset
near U32_MAX, wrap the derived DACL pointer below end_of_acl, and then
slip past the later pointer-based bounds checks. (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading real_parent in
do_task_stat() When reading /proc/. (CVE-2026-46259)

In the Linux kernel, the following vulnerability has been resolved:
io-wq: check that the predecessor is hashed in io_wq_remove_pending()
io_wq_remove_pending() needs to fix up wq->hash_tail. (CVE-2026-46274)

In the Linux kernel, the following vulnerability has been resolved:
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final
controller reference through nvmet_cq_put(). (CVE-2026-46304)

In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: Only release RCU read lock after ct_ft When looking
up a flow table in act_ct in tcf_ct_flow_table_get(),
rhashtable_lookup_fast() internally opens and closes an RCU read
critical section before returning ct_ft. (CVE-2026-46319)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0
contained a out-of-bounds (OOB) read when handling AppArmor
notifications. A local attacker could use this to cause kernel memory
corruption and, theoretically, influence processing of AppArmor
policies. (CVE-2026-47333)

Update instructions

The problem can be corrected by updating your kernel livepatch to the
following versions:

Ubuntu 20.04 LTS
    generic - 121.4
    lowlatency - 121.4

Ubuntu 18.04 LTS
    aws - 121.4
    azure - 121.4
    gcp - 121.4
    generic - 121.4
    lowlatency - 121.4
    oracle - 121.4

Ubuntu 24.04 LTS
    aws - 121.4
    azure - 121.4
    gcp - 121.4
    generic - 121.4
    gke - 121.4
    ibm - 121.4
    oracle - 121.4

Ubuntu 16.04 LTS
    aws - 121.4
    azure - 121.4
    gcp - 121.4
    generic - 121.4
    lowlatency - 121.4

Ubuntu 22.04 LTS
    aws - 121.4
    aws - 121.6
    aws - 121.7
    azure - 121.4
    gcp - 121.4
    gcp - 121.6
    gcp - 121.7
    generic - 121.4
    generic - 121.6
    generic - 121.7
    gke - 121.4
    ibm - 121.4
    ibm - 121.6
    ibm - 121.7

Support Information

Livepatches for supported LTS kernels will receive upgrades for a
period
of up to 13 months after the build date of the kernel.

Livepatches for supported HWE kernels which are not based on an LTS
kernel version will receive upgrades for a period of up to 9 months
after the build date of the kernel, or until the end of support for
that
kernel’s non-LTS distro release version, whichever is sooner.

References

- CVE-2025-68263
- CVE-2026-23428
- CVE-2026-23455
- CVE-2026-31402
- CVE-2026-31405
- CVE-2026-31431
- CVE-2026-31478
- CVE-2026-31607
- CVE-2026-31637
- CVE-2026-31657
- CVE-2026-31659
- CVE-2026-31705
- CVE-2026-43011
- CVE-2026-43037
- CVE-2026-43038
- CVE-2026-43185
- CVE-2026-43186
- CVE-2026-43304
- CVE-2026-43341
- CVE-2026-43406
- CVE-2026-43407
- CVE-2026-43493
- CVE-2026-43501
- CVE-2026-45988
- CVE-2026-46043
- CVE-2026-46119
- CVE-2026-46135
- CVE-2026-46185
- CVE-2026-46195
- CVE-2026-46259
- CVE-2026-46274
- CVE-2026-46304
- CVE-2026-46319
- CVE-2026-47333

More information about the ubuntu-security-announce mailing list