USN-8728-1: Linux kernel (GCP) vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-7.0.0-1011-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-image-7.0.0-1011-gcp-64kto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64kto a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-64k-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-image-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
Linux kernel (GCP)to a version that resolves this vulnerability.Patch USN-8728-1
Event History
Frequently Asked Questions
What level of access does an attacker need?
The described processor issues require a local attacker. The Arm issue could allow writes after permission has been revoked, while the AMD Zen 2 issue could allow corruption of instructions executed at a higher privilege level.
Which systems are most directly exposed to the processor-specific issues?
The TLB invalidation issue affects some Arm processors. The operation-cache isolation issue affects AMD Zen 2 processors; the notice also states that additional kernel security issues are corrected without identifying their affected hardware or attack conditions.
Which Ubuntu kernel packages are covered by this notice?
The notice covers linux-image-7.0.0-1011-gcp, linux-image-7.0.0-1011-gcp-64k, linux-image-gcp, linux-image-gcp-64k, and linux-image-gcp-64k-7.0.