Home / mailings [USN-8924-1] Linux kernel vulnerabilities
Posted on 13 October 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8924-1
October 13, 2026
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
It was discovered that the timer stats implementation in the Linux kernel
allowed the discovery of a real PID value while inside a PID namespace. A
local attacker could use this to expose sensitive information.
(CVE-2017-5967)
Wen Xu discovered that the XFS file system implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13097, CVE-2018-13100)
It was discovered that the Qualcomm Atheros 60GHz wireless driver in the
Linux kernel contained an integer overflow when validating the length of
certain information elements, leading to a buffer overflow. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-5848)
Likang Luo discovered that a race condition existed in the Bluetooth
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2021-3752)
It was discovered that the eventpoll (aka epoll) implementation in the
Linux kernel did not properly handle certain error conditions when adding
file descriptors, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2021-39634)
Jann Horn discovered a race condition in the Unix domain socket
implementation in the Linux kernel that could result in a read-after-free.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2021-4083)
Lyu Tao discovered that the NFS implementation in the Linux kernel did not
properly handle requests to open a directory on a regular file. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2022-24448)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- IPv6 networking;
- Netfilter;
(CVE-2026-53131)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS
linux-image-3.13.0-218-generic 3.13.0-218.269
Available with Ubuntu Pro
linux-image-3.13.0-218-lowlatency 3.13.0-218.269
Available with Ubuntu Pro
linux-image-generic 3.13.0.218.228
Available with Ubuntu Pro
linux-image-generic-lts-trusty 3.13.0.218.228
Available with Ubuntu Pro
linux-image-lowlatency 3.13.0.218.228
Available with Ubuntu Pro
linux-image-server 3.13.0.218.228
Available with Ubuntu Pro
linux-image-virtual 3.13.0.218.228
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-8924-1
CVE-2017-5967, CVE-2018-13093, CVE-2018-13097, CVE-2018-13100,
CVE-2018-5848, CVE-2021-3752, CVE-2021-39634, CVE-2021-4083,
CVE-2022-24448, CVE-2026-53131
--===============6397292762626004049==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
