LSN-121-1

Project Discussion Kernel LSN
, ,
1

Linux kernel vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 LTS
  • Ubuntu 24.04 LTS
  • Ubuntu 16.04 LTS
  • Ubuntu 22.04 LTS

Summary

Several security issues were fixed in the kernel.

Software Description

  • linux - Linux kernel
  • linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  • linux-azure - Linux kernel for Microsoft Azure Cloud systems
  • linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
  • linux-gke - Linux kernel for Google Container Engine (GKE) systems
  • linux-ibm - Linux kernel for IBM cloud systems
  • linux-oracle - Linux kernel for Oracle Cloud systems

Details

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack. (CVE-2025-68263)

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state. (CVE-2026-23428)

In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_conntrack_h323: check for zero length in
DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit
length from the packet, then decrements it by 1 to skip the protocol
discriminator byte before passing it to DecodeH323_UserInformation().
(CVE-2026-23455)

In the Linux kernel, the following vulnerability has been
resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0
replay cache uses a fixed 112-byte inline buffer
(rp_ibuf. (CVE-2026-31402)

In the Linux kernel, the following vulnerability has been
resolved: media: dvb-net: fix OOB access in ULE extension header tables The
ule_mandatory_ext_handlers. (CVE-2026-31405)

It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 “ksmbd: add
support for read compound”), response buffer management was changed to use
dynamic iov array. (CVE-2026-31478)

In the Linux kernel, the following vulnerability has been
resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When
a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit()
unconditionally overwrites urb->number_of_packets from the network PDU.
This value is subsequently used as the loop bound in usbip_recv_iso() and
usbip_pad_iso() to iterate over urb->iso_frame_desc. (CVE-2026-31607)

In the Linux kernel, the following vulnerability has been
resolved: rxrpc: reject undecryptable rxkad response tickets
rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses
the buffer as plaintext without checking whether crypto_skcipher_decrypt()
succeeded. (CVE-2026-31637)

In the Linux kernel, the following vulnerability has been
resolved: batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway’s last reference while readers still follow the pointer.
(CVE-2026-31657)

In the Linux kernel, the following vulnerability has been
resolved: batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. (CVE-2026-31659)

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after writing
each EA entry. (CVE-2026-31705)

In the Linux kernel, the following vulnerability has been
resolved: net/x25: Fix potential double free of skb When alloc_skb fails in
x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1
(error). (CVE-2026-43011)

In the Linux kernel, the following vulnerability has been
resolved: ip6_tunnel: clear skb2->cb. (CVE-2026-43037)

In the Linux kernel, the following vulnerability has been
resolved: ipv6: icmp: clear skb2->cb. (CVE-2026-43038)

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from
sp->max_recv_size and req->preferred_send_size to a signed int before
computing min_t(int, …). (CVE-2026-43185)

In the Linux kernel, the following vulnerability has been
resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to
decide how much data to write for each node. (CVE-2026-43186)

In the Linux kernel, the following vulnerability has been
resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the
key, verify that the key material would fit into a fixed-size buffer in
process_auth_done() and generally has a sane length. (CVE-2026-43304)

In the Linux kernel, the following vulnerability has been
resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace length
in a u8. (CVE-2026-43341)

In the Linux kernel, the following vulnerability has been
resolved: libceph: prevent potential out-of-bounds reads in
process_message_header() If the message frame is (maliciously) corrupted in
a way that the length of the control segment ends up being less than the
size of the message header or a different frame is made to look like a
message frame, out-of-bounds reads may ensue in process_message_header().
Perform an explicit bounds check before decoding the message header..
(CVE-2026-43406)

In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix potential out-of-bounds access in
ceph_handle_auth_reply() This patch fixes an out-of-bounds access in
ceph_handle_auth_reply() that can be triggered by a message of type
CEPH_MSG_AUTH_REPLY. (CVE-2026-43407)

In the Linux kernel, the following vulnerability has been
resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG
requests can return EBUSY. (CVE-2026-43493)

In the Linux kernel, the following vulnerability has been
resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. (CVE-2026-43501)

In the Linux kernel, the following vulnerability has been
resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet
gets a temporary failure during processing, it may end up in a partially
decrypted state - and then get requeued for a retry. (CVE-2026-45988)

In the Linux kernel, the following vulnerability has been
resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
rxe_rcv() currently checks only that the incoming packet is at least
header_size(pkt) bytes long before payload_size() is used. (CVE-2026-46043)

In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix slab-out-of-bounds access in auth message processing
If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a
positive value in its result field, it is treated as an error code by
ceph_handle_auth_reply() and returned to handle_auth_reply().
(CVE-2026-46119)

In the Linux kernel, the following vulnerability has been
resolved: nvmet-tcp: fix race between ICReq handling and queue teardown
nvmet_tcp_handle_icreq() updates queue->state after sending an
Initialization Connection Response (ICResp), but it does so without
serializing against target-side queue teardown. (CVE-2026-46135)

In the Linux kernel, the following vulnerability has been
resolved: smb/client: fix out-of-bounds read in symlink_data() Since
smb2_check_message() returns success without length validation for the
symlink error response, in symlink_data() it is possible for iov->iov_len
to be smaller than sizeof(struct smb2_err_rsp). (CVE-2026-46185)

In the Linux kernel, the following vulnerability has been
resolved: smb: client: validate dacloffset before building DACL pointers
parse_sec_desc(), build_sec_desc(), and the chown path in
id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd
before proving a DACL header fits inside the returned security descriptor.
On 32-bit builds a malicious server can return dacloffset near U32_MAX,
wrap the derived DACL pointer below end_of_acl, and then slip past the
later pointer-based bounds checks. (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been
resolved: procfs: fix missing RCU protection when reading real_parent in
do_task_stat() When reading /proc/. (CVE-2026-46259)

In the Linux kernel, the following vulnerability has been
resolved: io-wq: check that the predecessor is hashed in
io_wq_remove_pending() io_wq_remove_pending() needs to fix up
wq->hash_tail. (CVE-2026-46274)

In the Linux kernel, the following vulnerability has been
resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final
controller reference through nvmet_cq_put(). (CVE-2026-46304)

In the Linux kernel, the following vulnerability has been
resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When
looking up a flow table in act_ct in tcf_ct_flow_table_get(),
rhashtable_lookup_fast() internally opens and closes an RCU read critical
section before returning ct_ft. (CVE-2026-46319)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0
contained a out-of-bounds (OOB) read when handling AppArmor notifications.
A local attacker could use this to cause kernel memory corruption and,
theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Update instructions

The problem can be corrected by updating your kernel livepatch to the following
versions:

Ubuntu 20.04 LTS

  • generic - 121.4
  • lowlatency - 121.4

Ubuntu 18.04 LTS

  • aws - 121.4
  • azure - 121.4
  • gcp - 121.4
  • generic - 121.4
  • lowlatency - 121.4
  • oracle - 121.4

Ubuntu 24.04 LTS

  • aws - 121.4
  • azure - 121.4
  • gcp - 121.4
  • generic - 121.4
  • gke - 121.4
  • ibm - 121.4
  • oracle - 121.4

Ubuntu 16.04 LTS

  • aws - 121.4
  • azure - 121.4
  • gcp - 121.4
  • generic - 121.4
  • lowlatency - 121.4

Ubuntu 22.04 LTS

  • aws - 121.4
  • aws - 121.6
  • aws - 121.7
  • azure - 121.4
  • gcp - 121.4
  • gcp - 121.6
  • gcp - 121.7
  • generic - 121.4
  • generic - 121.6
  • generic - 121.7
  • gke - 121.4
  • ibm - 121.4
  • ibm - 121.6
  • ibm - 121.7

Support Information

Livepatches for supported LTS kernels will receive upgrades for
a period of up to 13 months after the build date of the kernel.

Livepatches for supported HWE kernels which are not based on
an LTS kernel version will receive upgrades for a period of
up to 9 months after the build date of the kernel, or until the end
of support for that kernel’s non-LTS distro release version,
whichever is sooner.

References