USN-8267-1: Linux kernel vulnerabilities

Q: What level of access does an attacker need for the AppArmor issues?

The AppArmor vulnerabilities are described as exploitable by an unprivileged local attacker. The advisory does not describe remote exploitation requirements for these specific issues.

Q: Could these flaws affect container isolation?

Yes. The AppArmor issues may allow an attacker to possibly escape a container, in addition to causing denial of service, exposing kernel memory, or escalating local privileges.

Q: Which installed kernel package families are explicitly listed as affected?

The listed software includes ubuntu/linux-image-4.15.0-2109-azure-fips, ubuntu/linux-image-azure-fips, ubuntu/linux-image-azure-fips-4.15, ubuntu/linux-image-4.15.0-1153-oracle, ubuntu/linux-image-4.15.0-1200-azure, and ubuntu/linux-image-azure. No fixed package versions are provided in the supplied data.

Published May 11, 2026

Updated

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Cryptographic API; - GPU drivers; - Network drivers; - UDF file system; - NFC subsystem; - Network traffic control; - Sun RPC protocol; - XFRM subsystem; (CVE-2024-27388, CVE-2024-46777, CVE-2024-46816, CVE-2024-49938, CVE-2024-50008, CVE-2024-50142, CVE-2025-21735, CVE-2025-37849, CVE-2026-23060, CVE-2026-23074, CVE-2026-23209)

Affected Software

18 affected componentsFixes available

Linux Kernel

All of the following

ubuntu/linux-image-4.15.0-2109-azure-fips<FIPS-140

FIPS-140

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-azure-fips<FIPS-140

FIPS-140

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-azure-fips-4.15<FIPS-140

FIPS-140

Ubuntu Ubuntu=18.04

All of the following

ubuntu/linux-image-4.15.0-1153-oracle<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/linux-image-4.15.0-1200-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/linux-image-azure<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/linux-image-oracle<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

ubuntu/linux-azure<4.15.0-1200.215~16.04.1

4.15.0-1200.215~16.04.1

ubuntu/linux-oracle<4.15.0-1153.164~16.04.1

4.15.0-1153.164~16.04.1

ubuntu/linux-azure-fips<4.15.0-2109.115

4.15.0-2109.115

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-image-4.15.0-2109-azure-fips to a version that resolves this vulnerability.
Fixed in FIPS-140
Upgrade
Upgrade ubuntu/linux-image-azure-fips to a version that resolves this vulnerability.
Fixed in FIPS-140
Upgrade
Upgrade ubuntu/linux-image-azure-fips-4.15 to a version that resolves this vulnerability.
Fixed in FIPS-140
Upgrade
Upgrade ubuntu/linux-image-4.15.0-1153-oracle to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-4.15.0-1200-azure to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-azure to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-oracle to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1200.215~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1153.164~16.04.1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2109.115
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Patch USN-8267-1

Event History

May 11, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·04:26 PM

Data Sourced

via OSV·04:26 PM

DescriptionAffected Software

Frequently Asked Questions

What level of access does an attacker need for the AppArmor issues?

The AppArmor vulnerabilities are described as exploitable by an unprivileged local attacker. The advisory does not describe remote exploitation requirements for these specific issues.

Could these flaws affect container isolation?

Yes. The AppArmor issues may allow an attacker to possibly escape a container, in addition to causing denial of service, exposing kernel memory, or escalating local privileges.

Which installed kernel package families are explicitly listed as affected?

The listed software includes ubuntu/linux-image-4.15.0-2109-azure-fips, ubuntu/linux-image-azure-fips, ubuntu/linux-image-azure-fips-4.15, ubuntu/linux-image-4.15.0-1153-oracle, ubuntu/linux-image-4.15.0-1200-azure, and ubuntu/linux-image-azure. No fixed package versions are provided in the supplied data.

USN-8267-1: Linux kernel vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need for the AppArmor issues?

Could these flaws affect container isolation?

Which installed kernel package families are explicitly listed as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need for the AppArmor issues?

Could these flaws affect container isolation?

Which installed kernel package families are explicitly listed as affected?