USN-7853-3: Linux kernel (Azure) vulnerabilities

Q: Who is exposed to the VMSCAPE issue?

Systems using a userspace hypervisor with guest VMs may be exposed on certain processors. The stated impact is disclosure of sensitive information from the host OS to an attacker operating in a guest VM.

Q: What access does an attacker need to exploit VMSCAPE?

The attacker needs the ability to run in a guest virtual machine. The issue is caused by insufficient branch predictor isolation between that guest and a userspace hypervisor.

Q: Which other kernel areas are covered by this update?

The update also addresses issues in the DMA engine, GPU drivers, HSI, Ethernet team driver, Ext4, timers, DCCP, IPv6, NET/ROM, SCTP, and USB sound devices. The advisory states that these issues could possibly be used to compromise the system.

Q: What should be updated?

Apply the kernel update for the affected Ubuntu Azure kernel packages identified by the advisory, including linux-azure and linux-image-azure variants. The provided information does not specify fixed package versions.

Published Nov 7, 2025

Updated

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose sensitive information from the host OS. (CVE-2025-40300)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - DMA engine subsystem; - GPU drivers; - HSI subsystem; - Ethernet team driver; - Ext4 file system; - Timer subsystem; - DCCP (Datagram Congestion Control Protocol); - IPv6 networking; - NET/ROM layer; - SCTP protocol; - USB sound devices; (CVE-2023-52574, CVE-2023-52650, CVE-2024-41006, CVE-2024-50006, CVE-2024-50299, CVE-2024-53124, CVE-2024-53150, CVE-2024-56767, CVE-2025-37838, CVE-2025-38352)

Affected Software

17 affected componentsFixes available

All of the following

ubuntu/linux-image-4.15.0-1194-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-azure-4.15<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-azure-lts-18.04<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-4.15.0-1194-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/linux-image-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/linux-image-4.15.0-1194-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=14.04

All of the following

ubuntu/linux-image-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=14.04

ubuntu/linux-azure<4.15.0-1194.209~14.04.1

4.15.0-1194.209~14.04.1

ubuntu/linux-azure<4.15.0-1194.209~16.04.1

4.15.0-1194.209~16.04.1

ubuntu/linux-azure-4.15<4.15.0-1194.209

4.15.0-1194.209

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-image-4.15.0-1194-azure to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-azure-4.15 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-azure-lts-18.04 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-azure to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209~14.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209~16.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-7853-3

Event History

Nov 7, 2025

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·12:43 PM

Data Sourced

via OSV·12:43 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to the VMSCAPE issue?

Systems using a userspace hypervisor with guest VMs may be exposed on certain processors. The stated impact is disclosure of sensitive information from the host OS to an attacker operating in a guest VM.

What access does an attacker need to exploit VMSCAPE?

The attacker needs the ability to run in a guest virtual machine. The issue is caused by insufficient branch predictor isolation between that guest and a userspace hypervisor.

Which other kernel areas are covered by this update?

The update also addresses issues in the DMA engine, GPU drivers, HSI, Ethernet team driver, Ext4, timers, DCCP, IPv6, NET/ROM, SCTP, and USB sound devices. The advisory states that these issues could possibly be used to compromise the system.

What should be updated?

Apply the kernel update for the affected Ubuntu Azure kernel packages identified by the advisory, including linux-azure and linux-image-azure variants. The provided information does not specify fixed package versions.

USN-7853-3: Linux kernel (Azure) vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to the VMSCAPE issue?

What access does an attacker need to exploit VMSCAPE?

Which other kernel areas are covered by this update?

What should be updated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to the VMSCAPE issue?

What access does an attacker need to exploit VMSCAPE?

Which other kernel areas are covered by this update?

What should be updated?