CERT-FR flags mass Ubuntu kernel flaws
CERT-FR advisory lists hundreds of Linux kernel vulnerabilities across multiple Ubuntu LTS/ESM releases, patched via Ubuntu's November 2026 USN bulletins.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published a consolidated advisory (CERTFR-2026-AVI-1537) aggregating a very large number of Linux kernel vulnerabilities affecting multiple Ubuntu releases, including Ubuntu 14.04 ESM, 16.04 ESM, 18.04 ESM, 22.04 LTS, 24.04 LTS and 26.04 LTS. The flaws stem from a batch of Ubuntu Security Notices (USN-9002-1 through USN-9035-1) issued between 6 and 10 November 2026, covering a wide range of kernel subsystems. Impacts vary by individual CVE and include arbitrary code execution, data integrity compromise, denial of service, and security policy bypass; the advisory does not indicate that any of the listed CVEs are being actively exploited in the wild.
Given the sheer volume of CVEs referenced (several hundred), this brief includes a representative sample of the most notable identifiers rather than an exhaustive list; the full set and per-package applicability should be verified against the referenced USN bulletins. As is typical for Ubuntu kernel roll-up advisories, affected components likely span core subsystems such as networking, filesystems, drivers and memory management, with exploitation generally requiring local access or crafted input depending on the specific flaw.
Defenders running any of the listed Ubuntu releases should prioritize patching via the standard Ubuntu update mechanism, referencing the specific USN bulletin applicable to their kernel flavor and release. No proof-of-concept exploitation or in-the-wild activity is noted in this advisory; treat as a routine but broad patch management action rather than an active incident.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1537
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs