Ubuntu USN-8661-5 Fixes Linux kernel (Raspberry Pi) Vulnerabilities
Tech GuruQuick Answer
USN-8661-5 fixes vulnerabilities in Ubuntu 22.04's Raspberry Pi kernel. Update the raspi image and matching metapackage, then reboot; the image version 5.15.0-1108.111 and metapackage version 5.15.0.1108.106 are different identifiers.
Confirm Scope And Apply The Supported Fix
What to do now: Record the Raspberry Pi model, installed Ubuntu kernel flavour and any external modules or peripherals. Apply the supported Jammy raspi update and arrange a reboot with recovery access.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Linux kernel (Raspberry Pi) packages on Ubuntu 22.04 LTS (jammy) |
|---|---|
| Advisory | USN-8661-5 |
| CVEs | CVE-2025-27558, CVE-2026-31414, CVE-2026-31448, CVE-2026-31705, CVE-2026-43198, CVE-2026-43378, CVE-2026-43499, CVE-2026-46266, CVE-2026-46331, CVE-2026-52924, CVE-2026-52989, CVE-2026-53086, CVE-2026-53176, CVE-2026-53212, CVE-2026-53215, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53359, CVE-2026-64531 |
| Authoritative release date | 2026-09-22 (Canonical publication date; no time specified) |
| Authority revision date | No separate USN revision timestamp verified. The former precise imported timestamp is not established as an advisory revision. |
| Affected versions | The Ubuntu releases and packages enumerated in USN-8661-5: Ubuntu 22.04 LTS (jammy). |
| Fixed version | Ubuntu 22.04 jammy: linux-image-5.15.0-1108-raspi version 5.15.0-1108.111.The listed linux-image-raspi, linux-image-raspi-5.15 and linux-image-raspi-nolpae metapackages use 5.15.0.1108.106. Select the installed supported flavour. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | USN-8661-5 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
Canonical highlights a WiFi mesh aggregated-frame issue that permits packet injection by a physically nearby attacker, alongside other kernel-subsystem fixes. Retain the full CVE list, but assess the Pi's hardware and enabled features rather than assuming every subsystem mentioned by the upstream kernel applies equally.
What To Validate Now
- Inventory. Locate Linux kernel (Raspberry Pi) packages on Ubuntu 22.04 LTS (jammy) deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The Ubuntu releases and packages enumerated in USN-8661-5: Ubuntu 22.04 LTS (jammy). Do not infer applicability from product family or severity alone.
- Remediate. Install the appropriate Jammy Raspberry Pi image and metapackage update, rebuild required external modules for the changed ABI, and reboot. A generic linux image from another flavour is not this update.
- Validate. Confirm the running 5.15.0-1108-raspi kernel after reboot, check required modules and peripherals, and test networking, storage and the device's normal workload. Record boot or module failures before wider rollout.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Canonical requires a reboot after this kernel update and warns of an ABI change. Recompile and reinstall any third-party kernel modules for the new ABI, and verify that this succeeds before relying on them after reboot. Keeping the standard kernel metapackages installed allows the normal upgrade to bring in the new kernel; it is not proof that every external driver rebuilt successfully. Check boot/recovery access, required drivers and rollback before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
