USN-8924-1: Linux kernel vulnerabilities

In plain language

What this advisory means

Multiple security issues were found in the Linux kernel on Ubuntu systems. These include vulnerabilities that might let local attackers gain sensitive information or cause system crashes by using specially crafted files or exploiting kernel subsystems. Updated Linux kernel packages have been released to address these problems.

Technical explanation

How the issue affects the environment

The Linux kernel had several vulnerabilities: the timer stats implementation exposed real PIDs inside namespaces (CVE-2017-5967), XFS and f2fs file systems did not properly validate metadata and inode states allowing malicious images to cause denial of service (CVE-2018-13093, CVE-2018-13097, CVE-2018-13100), the Qualcomm Atheros driver suffered an integer overflow leading to buffer overflow (CVE-2018-5848), Bluetooth and epoll subsystems had race conditions leading to use-after-free vulnerabilities (CVE-2021-3752, CVE-2021-39634), Unix domain sockets had a read-after-free race condition (CVE-2021-4083), and the NFS implementation improperly handled directory opens on regular files, exposing kernel memory (CVE-2022-24448). Additionally, flaws in IPv6 networking and Netfilter were corrected (CVE-2026-53131). These issues could be exploited by local attackers to expose sensitive information, cause system crashes, or possibly execute arbitrary code.

Operational impact

Why teams should care

These vulnerabilities could allow attackers with local access to gain sensitive kernel memory information, trigger system crashes causing denial of service, or possibly execute arbitrary code, thus compromising the affected Ubuntu systems. This poses risks to system stability, confidentiality, and overall security posture, potentially leading to service interruptions and unauthorized data exposure.

Affected and fixed releases

Temporary risk reduction

The official advisory does not specify any workaround. Until the kernel is updated and the system rebooted, systems remain vulnerable, so limit local access to trusted users to reduce risk.

Evidence and validation checklist

• Discovery of timer stats PID namespace information leak (CVE-2017-5967)
• Wen Xu's discovery of XFS and f2fs metadata validation flaws (CVE-2018-13093, CVE-2018-13097, CVE-2018-13100)
• Qualcomm Atheros 60GHz wireless driver integer overflow and buffer overflow (CVE-2018-5848)
• Race conditions resulting in use-after-free in Bluetooth and epoll subsystems (CVE-2021-3752, CVE-2021-39634)
• Race condition and read-after-free in Unix domain socket implementation (CVE-2021-4083)
• NFS implementation mishandling directory open on regular file (CVE-2022-24448)
• Fixes for IPv6 networking and Netfilter flaws (CVE-2026-53131)
• Released fixed kernel package versions requiring system reboot and module recompilation