# CERT-FR flags mass Ubuntu kernel flaws

Published: 2026-11-13 · Severity: routine
Canonical: https://vorant.io/reports/0a3fc949-f55a-5ffa-b031-01eec42a8d30/cert-fr-flags-mass-ubuntu-kernel-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists hundreds of Linux kernel vulnerabilities across multiple Ubuntu LTS/ESM releases, patched via Ubuntu's November 2026 USN bulletins.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1537

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published a consolidated advisory (CERTFR-2026-AVI-1537) aggregating a very large number of Linux kernel vulnerabilities affecting multiple Ubuntu releases, including Ubuntu 14.04 ESM, 16.04 ESM, 18.04 ESM, 22.04 LTS, 24.04 LTS and 26.04 LTS. The flaws stem from a batch of Ubuntu Security Notices (USN-9002-1 through USN-9035-1) issued between 6 and 10 November 2026, covering a wide range of kernel subsystems. Impacts vary by individual CVE and include arbitrary code execution, data integrity compromise, denial of service, and security policy bypass; the advisory does not indicate that any of the listed CVEs are being actively exploited in the wild.

Given the sheer volume of CVEs referenced (several hundred), this brief includes a representative sample of the most notable identifiers rather than an exhaustive list; the full set and per-package applicability should be verified against the referenced USN bulletins. As is typical for Ubuntu kernel roll-up advisories, affected components likely span core subsystems such as networking, filesystems, drivers and memory management, with exploitation generally requiring local access or crafted input depending on the specific flaw.

Defenders running any of the listed Ubuntu releases should prioritize patching via the standard Ubuntu update mechanism, referencing the specific USN bulletin applicable to their kernel flavor and release. No proof-of-concept exploitation or in-the-wild activity is noted in this advisory; treat as a routine but broad patch management action rather than an active incident.

## Mentioned in this report

- Vulnerabilities: CVE-2017-9986, CVE-2022-1205, CVE-2022-23036, CVE-2022-23037, CVE-2022-3114, CVE-2023-20585, CVE-2023-52676, CVE-2023-52784, CVE-2023-53707, CVE-2024-40954, CVE-2024-41062, CVE-2024-46754, CVE-2024-53056, CVE-2024-56552, CVE-2024-56763, CVE-2024-57904, CVE-2024-57999, CVE-2025-21649, CVE-2025-21759, CVE-2025-21985, CVE-2025-22057, CVE-2025-23131, CVE-2025-37807, CVE-2025-38069, CVE-2025-38187, CVE-2025-38204, CVE-2025-38525, CVE-2025-39726, CVE-2025-39929, CVE-2025-40074, CVE-2025-40158, CVE-2026-23137, CVE-2026-31420, CVE-2026-43010, CVE-2026-45850, CVE-2026-46003, CVE-2026-52908, CVE-2026-53005, CVE-2026-53132, CVE-2026-53250

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1537

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0a3fc949-f55a-5ffa-b031-01eec42a8d30/cert-fr-flags-mass-ubuntu-kernel-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup