# Ubuntu Patches Dozens of Linux Kernel Flaws

Published: 2026-11-06 · Severity: routine
Canonical: https://vorant.io/reports/884afeb8-6b89-53e9-a6cf-c25595e70222/ubuntu-patches-dozens-of-linux-kernel-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory details over 300 Linux kernel CVEs patched across Ubuntu 14.04–26.04, some enabling arbitrary code execution and privilege bypass.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1469

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published an advisory (CERTFR-2026-AVI-1469) consolidating ten Ubuntu Security Notices (USN-8959-1 through USN-8968-1) issued on 3 November 2026, covering an extremely large number of Linux kernel vulnerabilities affecting Ubuntu 14.04 ESM through the upcoming 26.04 LTS release. The advisory does not provide per-CVE technical detail but groups the risks into four categories: arbitrary code execution, data integrity compromise, security policy bypass, and denial of service, with some issues left unspecified by the vendor. Given the breadth of affected releases (spanning over a decade of LTS and ESM branches) this is a routine, large-scale kernel maintenance update rather than a report of in-the-wild exploitation.

No exploitation is claimed in the advisory, no indicators of compromise are provided, and no specific attacker or campaign is named. Defenders running any of the listed Ubuntu versions should apply the kernel updates referenced in USN-8959-1 through USN-8968-1 at the earliest convenient maintenance window, prioritizing systems where local or network-adjacent attackers could trigger memory-safety or logic bugs in kernel subsystems (networking, filesystems, drivers) to escalate privileges or crash the system. Because the bulletin aggregates fixes across dozens of kernel subsystems and years of flaws, no single CVE stands out as critical based on the available description; treat this as standard patch-management hygiene for Ubuntu kernel fleets.

## Mentioned in this report

- Vulnerabilities: CVE-2021-28714, CVE-2021-3640, CVE-2022-1205, CVE-2022-3114, CVE-2022-49058, CVE-2022-49082, CVE-2022-49149, CVE-2022-49170, CVE-2022-49182, CVE-2022-49201, CVE-2023-52676, CVE-2023-53231, CVE-2023-53320, CVE-2023-53707, CVE-2024-41062, CVE-2024-46754, CVE-2024-49568, CVE-2024-50017, CVE-2024-53187, CVE-2024-53210, CVE-2025-21649, CVE-2025-21759, CVE-2025-22026, CVE-2025-23131, CVE-2025-37861, CVE-2025-38069, CVE-2025-38239, CVE-2025-39726, CVE-2025-39810, CVE-2025-40054, CVE-2026-23191, CVE-2026-31420, CVE-2026-43064, CVE-2026-45850, CVE-2026-46052, CVE-2026-52909, CVE-2026-53078, CVE-2026-63794, CVE-2026-64002, CVE-2026-64116

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1469

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/884afeb8-6b89-53e9-a6cf-c25595e70222/ubuntu-patches-dozens-of-linux-kernel-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup