USN-8373-1: Linux kernel vulnerabilities
It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300) Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330) Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333) Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334) Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335) Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AFINET/AFINET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336) Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a kernel oops. (CVE-2026-47337) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1026-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1026-nvidia-tegra-rtto a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1042-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1042.45 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1054-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1054-oracle-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-gke-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidia-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidia-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-aws-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-aws-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1057.61 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1058-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1060-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1060-gcp-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1060-gcp-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-124-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-124-genericto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-124-generic-64kto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-2046-raspi-realtimeto a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-6.8.1-1052-realtimeto a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-aws-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-aws-64k-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-aws-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-aws-fips-6.8to a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-aws-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60 - Upgrade
Upgrade
ubuntu/linux-image-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-image-azure-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-image-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-fips-6.8to a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64k-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-gcp-fipsto a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-gcp-fips-6.8to a version that resolves this vulnerability.Fixed in FIPS-140 - Upgrade
Upgrade
ubuntu/linux-image-gcp-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-image-genericto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-generic-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-generic-64kto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-generic-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-generic-lpaeto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-gke-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-gke-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-gke-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.61 - Upgrade
Upgrade
ubuntu/linux-image-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1042.45 - Upgrade
Upgrade
ubuntu/linux-image-gkeop-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1042.45 - Upgrade
Upgrade
ubuntu/linux-image-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-image-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-image-ibm-classicto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-image-ibm-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-image-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-intel-iotgto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-kvmto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-lowlatency-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-lowlatency-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-rtto a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-rt-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-image-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-oracle-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-oracle-64k-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-oracle-lts-24.04to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55 - Upgrade
Upgrade
ubuntu/linux-image-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1057.61 - Upgrade
Upgrade
ubuntu/linux-image-raspi-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.61 - Upgrade
Upgrade
ubuntu/linux-image-raspi-realtimeto a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-raspi-realtime-6.8to a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-realtimeto a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-realtime-6.8.1to a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-virtualto a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-virtual-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1054-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1054-oracle-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1055-nvidia-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-aws-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1057-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1060-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1060-gcp-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-124-genericto a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-124-generic-64kto a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-aws-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-aws-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-generic-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-generic-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-generic-64k-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-generic-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-64k-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-1055.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04ato a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04bto a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04cto a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04dto a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oracle-64kto a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-oracle-64k-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1054.55~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-realtime-hwe-22.04to a version that resolves this vulnerability.Fixed in Real-time - Upgrade
Upgrade
ubuntu/linux-image-virtual-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-virtual-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.8.0-124.124~22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-8373-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-8373-1?
The severity of USN-8373-1, relating to several Linux kernel vulnerabilities, is classified as risk level 55.
What vulnerabilities are addressed in USN-8373-1?
USN-8373-1 addresses multiple Linux kernel vulnerabilities including CVE-2026-47337, CVE-2026-47336, and CVE-2026-47335.
How do I fix USN-8373-1?
To fix USN-8373-1, ensure that your Ubuntu Linux kernel is updated to the latest available version.
What systems are affected by USN-8373-1?
USN-8373-1 affects all supported versions of the Ubuntu Linux kernel.
Are there any known exploits for USN-8373-1?
As of now, there are no publicly reported exploits specifically for the vulnerabilities addressed in USN-8373-1.