USN-8728-1: Linux kernel (GCP) vulnerabilities

In plain language

What this advisory means

Multiple security holes were found in the Linux kernel used by Ubuntu on Google Cloud Platform (GCP). Some Arm processors could incorrectly invalidate memory permissions, letting a local attacker write to memory after access was revoked, risking privilege escalation (CVE-2025-10263). Some AMD Zen 2 processors had cache issues allowing attackers to corrupt higher-level instructions, also risking privilege escalation (CVE-2025-54518). Numerous other Linux kernel subsystems had vulnerabilities that could allow attackers to compromise systems.

Technical explanation

How the issue affects the environment

The Linux kernel for GCP had several vulnerabilities, including faulty broadcast TLB invalidation on some Arm processors. This leads to memory writes being completed before invalidations propagate globally, allowing local attackers to write to memory after permissions are revoked, bypassing protections (CVE-2025-10263). Additionally, AMD Zen 2 processors fail to properly isolate shared operation cache resources, enabling attackers to corrupt instructions at higher privilege levels and escalate privileges (CVE-2025-54518). Numerous Linux kernel subsystems across various architectures and drivers had security flaws enabling possible system compromises. The update addresses these flaws across wide kernel components including architectures (ARM64, x86, MIPS, PowerPC, RISC-V), drivers (network, USB, GPU), filesystems, and kernel subsystems (memory management, crypto, scheduling, etc).

Operational impact

Why teams should care

Systems running affected Linux kernel versions on GCP are vulnerable to local attacks that can lead to unauthorized memory modification or privilege escalation. This puts the confidentiality, integrity, and availability of systems and data at risk. Attackers exploiting these vulnerabilities might gain control over kernels or escalate their privileges, impacting workloads and services on Microsoft Azure and cloud infrastructures using these Ubuntu kernels.

Affected and fixed releases

Temporary risk reduction

The advisory does not specify any workaround other than applying the kernel update and rebooting the system.

Evidence and validation checklist

• Vulnerabilities in Arm processors' TLB invalidation (CVE-2025-10263)
• AMD Zen 2 processors' operation cache resource isolation failure (CVE-2025-54518)
• Vulnerabilities across many Linux kernel subsystems and architectures
• Update to linux-image-gcp 7.0.0-1011.11~24.04.1 addresses these issues
• Reboot and recompilation of kernel modules required to complete remediation