Last updated 5 June 2026

Ubuntu Linux 6.8 GA retains the legacy AFUNIX garbage collector but backports upstream commit 8594d9b85c07 ("afunix: Don’t call skbget() for OOB skb"). When orphaned MSGOOB sockets hit unixgc(), the garbage collector still calls kfreeskb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.

The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spinlock and spinunlock functions, which allows remote attackers to cause a denial of service (machine crash) via a flood of network traffic.

Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a local wireless network that specify long ESSIDs.