Ubuntu Updates .NET 8, 10, and 11 for Three Vulnerabilities
Tech GuruQuick Answer
Ubuntu USN-8958-1 fixes three .NET vulnerabilities across supported Ubuntu releases. Inventory installed runtimes, SDKs, containers and applications, apply the exact repository packages for each release, restart workloads so fixed runtimes load, validate applications, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu hosts and images with dotnet8, dotnet10 or dotnet11 runtimes and SDKs, exact package versions, Blazor debug-proxy use, applications, owners, and repositories. Match each package and Ubuntu release to the USN table; do not apply dotnet10 or dotnet11 scope to .NET 8, and do not infer all three issues affect every package. Run the standard supported Ubuntu update process and install the exact USN-8958-1 package versions from the correct release repositories, then rebuild images and restart .NET workloads. Confirm installed and loaded runtime versions, test application, debugging and deployment workflows, scan images for superseded runtimes, and retain package and change evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ubuntu .NET 8, .NET 10, and .NET 11 packages on Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as listed |
|---|---|
| Advisory | USN-8958-1 |
| CVEs | CVE-2026-102870, CVE-2026-111497, CVE-2026-114148 |
| Authoritative release date | 2026-10-29 17:02:55 UTC |
| Authority revision date | 2026-10-29 17:02:55 UTC |
| Affected versions | The USN-listed dotnet8, dotnet10, and dotnet11 packages; CVE-2026-102870 affects only dotnet10 and dotnet11, while release and package scope differ for the other issues. |
| Fixed version | The exact Ubuntu package versions listed in USN-8958-1, including .NET 8.0.33, .NET 10.0.14, and .NET 11.0.0-rc3 packages on the supported releases where offered |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Ubuntu corrected an incomplete Blazor debug-proxy fix, Brotli decompression memory corruption, and a file-ownership issue that could allow local privilege escalation.
What To Validate Now
- Inventory. Inventory Ubuntu hosts and images with dotnet8, dotnet10 or dotnet11 runtimes and SDKs, exact package versions, Blazor debug-proxy use, applications, owners, and repositories.
- Establish applicability. Match each package and Ubuntu release to the USN table; do not apply dotnet10 or dotnet11 scope to .NET 8, and do not infer all three issues affect every package.
- Remediate. Run the standard supported Ubuntu update process and install the exact USN-8958-1 package versions from the correct release repositories, then rebuild images and restart .NET workloads.
- Validate. Confirm installed and loaded runtime versions, test application, debugging and deployment workflows, scan images for superseded runtimes, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The notice includes a release-candidate .NET 11 package on Ubuntu 26.10 and an incomplete earlier fix. Preserve branch and repository boundaries and test application compatibility.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
