# Ubuntu Linux kernel multiple privilege escalation flaws

Published: 2026-07-10 · Severity: elevated
Canonical: https://vorant.io/reports/73a19a3a-522c-555b-bdc3-b141c3ee6751/ubuntu-linux-kernel-multiple-privilege-escalation-flaws

> Multiple Linux kernel vulnerabilities across Ubuntu 18.04 ESM through 26.04 LTS enable privilege escalation and data compromise.

CERT-FR has published an advisory documenting multiple vulnerabilities discovered in the Linux kernel affecting Ubuntu systems across multiple versions: 18.04 ESM, 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. The vulnerabilities permit local privilege escalation, data confidentiality compromise, and security policy bypass. Ubuntu has released coordinated security updates across multiple USN (Ubuntu Security Notice) bulletins published in early July 2026, with patches available for all affected releases. Administrators should apply the kernel updates from the referenced Ubuntu security notices immediately, as these flaws can be exploited by local attackers to elevate privileges and access sensitive data.

## Mentioned in this report

- Vulnerabilities: CVE-2021-47202, CVE-2022-48816, CVE-2023-53673, CVE-2024-35862, CVE-2024-50060, CVE-2024-56643, CVE-2025-37778, CVE-2025-37822, CVE-2025-37924, CVE-2025-38201, CVE-2025-40005, CVE-2025-40082, CVE-2025-54505, CVE-2025-68214, CVE-2025-68263, CVE-2025-71088, CVE-2025-71089, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0861

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/73a19a3a-522c-555b-bdc3-b141c3ee6751/ubuntu-linux-kernel-multiple-privilege-escalation-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup