# CERT-FR flags mass Ubuntu kernel flaws

Published: 2026-10-23 · Severity: elevated
Canonical: https://vorant.io/reports/6196aadf-d740-539b-a5a3-d116e0391824/cert-fr-flags-mass-ubuntu-kernel-flaws

> CERT-FR advisory lists dozens of Linux kernel vulnerabilities across all supported Ubuntu releases, some allowing remote code execution and privilege escalation.

CERT-FR has published an advisory consolidating multiple Ubuntu Security Notices (USN-8908-2 through USN-8933-1) addressing a large batch of Linux kernel vulnerabilities affecting Ubuntu 14.04 through 26.04 (ESM and LTS releases). The flaws span a wide range of impact categories including remote code execution, privilege escalation, denial of service, data integrity and confidentiality breaches, security policy bypass, and even web-related issues like XSS and CSRF, indicating the batch covers multiple kernel subsystems and drivers rather than a single flaw class.

No evidence of active in-the-wild exploitation is mentioned in the advisory; it is a standard vulnerability disclosure and patch notification rather than an incident report. Given the broad range of affected Ubuntu versions (including long-term ESM support for older releases), this impacts a large base of Linux server and desktop deployments.

Defenders should prioritize patching per the referenced Ubuntu Security Notices, verifying kernel versions against the specific USN bulletins applicable to their Ubuntu release. Given the volume of CVEs (over 80 referenced), organizations should triage based on exposure (e.g., whether affected kernel modules/drivers are in use) and apply vendor-supplied kernel updates through standard patch management processes.

## Mentioned in this report

- Vulnerabilities: CVE-2017-20285, CVE-2019-25777, CVE-2025-40778, CVE-2025-8677, CVE-2026-106552, CVE-2026-106553, CVE-2026-106555, CVE-2026-106582, CVE-2026-106583, CVE-2026-106584, CVE-2026-106585, CVE-2026-106586, CVE-2026-106587, CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11622, CVE-2026-11721, CVE-2026-13204, CVE-2026-13321, CVE-2026-1519, CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19774, CVE-2026-19941, CVE-2026-39821, CVE-2026-58415, CVE-2026-63045, CVE-2026-63292, CVE-2026-63676, CVE-2026-63686, CVE-2026-63718, CVE-2026-66070, CVE-2026-66077, CVE-2026-66079, CVE-2026-67231, CVE-2026-67232

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1376

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6196aadf-d740-539b-a5a3-d116e0391824/cert-fr-flags-mass-ubuntu-kernel-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup