Ubuntu Patches Dozens of Linux Kernel Flaws
CERT-FR advisory details over 300 Linux kernel CVEs patched across Ubuntu 14.04–26.04, some enabling arbitrary code execution and privilege bypass.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory (CERTFR-2026-AVI-1469) consolidating ten Ubuntu Security Notices (USN-8959-1 through USN-8968-1) issued on 3 November 2026, covering an extremely large number of Linux kernel vulnerabilities affecting Ubuntu 14.04 ESM through the upcoming 26.04 LTS release. The advisory does not provide per-CVE technical detail but groups the risks into four categories: arbitrary code execution, data integrity compromise, security policy bypass, and denial of service, with some issues left unspecified by the vendor. Given the breadth of affected releases (spanning over a decade of LTS and ESM branches) this is a routine, large-scale kernel maintenance update rather than a report of in-the-wild exploitation.
No exploitation is claimed in the advisory, no indicators of compromise are provided, and no specific attacker or campaign is named. Defenders running any of the listed Ubuntu versions should apply the kernel updates referenced in USN-8959-1 through USN-8968-1 at the earliest convenient maintenance window, prioritizing systems where local or network-adjacent attackers could trigger memory-safety or logic bugs in kernel subsystems (networking, filesystems, drivers) to escalate privileges or crash the system. Because the bulletin aggregates fixes across dozens of kernel subsystems and years of flaws, no single CVE stands out as critical based on the available description; treat this as standard patch-management hygiene for Ubuntu kernel fleets.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1469
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs