USN-8305-2: Linux kernel (Low Latency) vulnerabilities

Q: Who is realistically exposed to the Copy Fail flaw?

Systems running the affected Ubuntu low-latency kernel packages are exposed if a local attacker can execute code on the host. Containerized environments may also be at risk because the flaw could potentially be used to escape a container.

Q: What level of access does an attacker need?

For CVE-2026-31431, the attacker needs local access. The available information does not specify the access requirements or exploit conditions for the other corrected kernel issues.

Q: Which kernel areas are covered by this update?

The update addresses issues in the Cryptographic API, Ethernet bonding driver, packet sockets, and TLS protocol. It specifically identifies the algif_aead module as affected by the Copy Fail issue.

Q: How can I determine whether a system needs this update?

Check whether the system is running one of the listed Ubuntu low-latency kernel packages, including linux-lowlatency and the 5.15.0-179 low-latency image packages. The advisory data does not provide fixed package versions or other detection indicators.

Published May 26, 2026

Updated

It was discovered that the Linux kernel algifaead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Cryptographic API; - Ethernet bonding driver; - Packet sockets; - TLS protocol; (CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)

Affected Software

14 affected componentsFixes available

ubuntu/linux-lowlatency

All of the following

ubuntu/linux-image-5.15.0-179-lowlatency<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/linux-image-5.15.0-179-lowlatency-64k<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/linux-image-lowlatency-5.15<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/linux-image-lowlatency-64k-5.15<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/linux-image-lowlatency-64k-hwe-20.04<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/linux-image-lowlatency-hwe-20.04<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-179.189~20.04.1

5.15.0-179.189~20.04.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-image-5.15.0-179-lowlatency to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-5.15.0-179-lowlatency-64k to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-lowlatency-5.15 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-lowlatency-64k-5.15 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-lowlatency-64k-hwe-20.04 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-image-lowlatency-hwe-20.04 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-179.189~20.04.1
Upgrade
Upgrade linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Patch USN-8305-2

Event History

May 26, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·07:08 PM

Data Sourced

via OSV·07:08 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who is realistically exposed to the Copy Fail flaw?

Systems running the affected Ubuntu low-latency kernel packages are exposed if a local attacker can execute code on the host. Containerized environments may also be at risk because the flaw could potentially be used to escape a container.

What level of access does an attacker need?

For CVE-2026-31431, the attacker needs local access. The available information does not specify the access requirements or exploit conditions for the other corrected kernel issues.

Which kernel areas are covered by this update?

The update addresses issues in the Cryptographic API, Ethernet bonding driver, packet sockets, and TLS protocol. It specifically identifies the algif_aead module as affected by the Copy Fail issue.

How can I determine whether a system needs this update?

Check whether the system is running one of the listed Ubuntu low-latency kernel packages, including linux-lowlatency and the 5.15.0-179 low-latency image packages. The advisory data does not provide fixed package versions or other detection indicators.

USN-8305-2: Linux kernel (Low Latency) vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to the Copy Fail flaw?

What level of access does an attacker need?

Which kernel areas are covered by this update?

How can I determine whether a system needs this update?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to the Copy Fail flaw?

What level of access does an attacker need?

Which kernel areas are covered by this update?

How can I determine whether a system needs this update?