Multiple security vulnerabilities were found in the Linux kernel used by Ubuntu, including problems with the NTFS file system and certain AMD processors that could expose sensitive information or allow attackers to gain higher privileges on the system. These issues affect many parts of the kernel and various drivers, potentially allowing attackers to compromise the system. Updates have been provided to address these problems.
Published 28/7/2026, 7:31:41 amVerified 30/7/2026, 3:14:13 pmRevision 1
In plain language
What this advisory means
Multiple security vulnerabilities were found in the Linux kernel used by Ubuntu, including problems with the NTFS file system and certain AMD processors that could expose sensitive information or allow attackers to gain higher privileges on the system. These issues affect many parts of the kernel and various drivers, potentially allowing attackers to compromise the system. Updates have been provided to address these problems.
Technical explanation
How the issue affects the environment
A vulnerability was identified in the Linux kernel's NTFS file system implementation where file name length validation was insufficient in certain cases. This flaw (CVE-2023-45896) can cause an out-of-bounds read, enabling an attacker to craft a malicious NTFS image that, once mounted and accessed, could leak kernel memory contents. Additionally, some AMD processors were found to fail to properly clear data in the floating point divider unit during speculative execution, permitting local attackers to expose sensitive information (CVE-2025-54505). Furthermore, AMD Zen 2 processors exhibited inadequate isolation of shared resources in the operation cache, which a local attacker might exploit to corrupt higher-privilege-level executed instructions, potentially leading to privilege escalation (CVE-2025-54518). Numerous other security fixes address vulnerabilities across multiple CPU architectures (ARM32, ARM64, MIPS, PowerPC, S390, x86) and various kernel subsystems and drivers. These cumulative issues could allow attackers to compromise the system if exploited successfully. The update involves multiple packages corresponding to kernel versions used in Ubuntu 20.04 LTS and related Azure and Oracle Cloud system kernels. Due to an ABI change, recompilation of third-party kernel modules is required after upgrading.
Operational impact
Why teams should care
Exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive kernel memory, local privilege escalation, and potentially full system compromise, impacting the confidentiality, integrity, and availability of affected Ubuntu systems. This may affect businesses relying on Ubuntu for cloud or on-premises deployments and highlights the importance of installing security updates promptly to reduce exposure to these risks.
Immediate action
To address these security vulnerabilities, users should update their systems with the latest Linux kernel packages provided for their Ubuntu release (such as 20.04 LTS) and related cloud-specific kernels (Azure, Oracle). After applying the updates, a system reboot is required to load the new kernel. Due to ABI changes, any third-party kernel modules must be recompiled and reinstalled. Enabling Ubuntu Pro provides extended security coverage and access to these fixes.
Affected and fixed releases
Affected versionsConfirm in the official vendor advisory
No specific workarounds are provided by the official source. Users should apply the available security updates and reboot to mitigate the vulnerabilities.
Evidence and validation checklist
Description of NTFS file system flaw leading to out-of-bounds read and possible leak of kernel memory (CVE-2023-45896).
AMD processor speculative execution clearing issue exposing sensitive information (CVE-2025-54505).
AMD Zen 2 processor operation cache isolation issue enabling possible privilege escalation (CVE-2025-54518).
List of multiple kernel subsystems and drivers updated to fix various security issues.
Instructions to update kernel packages and reboot system.
Notification of ABI changes requiring recompilation of third-party modules.
Authoritative reference
Ubuntu Security Notices
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.
