Ubuntu USN-8729-6 Updates AWS Kernels for 97 Vulnerabilities

Quick Answer

USN-8729-6 updates the AWS 6.8 kernel line for Ubuntu 22.04 and 24.04. Install the matching kernel image and metapackage through the supported security repository, then reboot into the fixed kernel. Updating only a container image or restarting an application does not replace its host's running kernel.

Last verified: October 2, 2026 UTC against Canonical's notice and JSON. No instance was updated or rebooted.

Scope And Authority

Product scope	Linux kernel (AWS) vulnerabilities on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
Advisory	USN-8729-6
CVEs	CVE-2025-71289, CVE-2026-23469, CVE-2026-31420, CVE-2026-31486, CVE-2026-31560, CVE-2026-46158, CVE-2026-46170, CVE-2026-46275, CVE-2026-46315, CVE-2026-52912, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52926, CVE-2026-52941, CVE-2026-53357, CVE-2026-64015, CVE-2026-64018, CVE-2026-64025, CVE-2026-64029, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048, CVE-2026-64051, CVE-2026-64055, CVE-2026-64056, CVE-2026-64064, CVE-2026-64073, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64092, CVE-2026-64096, CVE-2026-64097, CVE-2026-64098, CVE-2026-64102, CVE-2026-64103, CVE-2026-64106, CVE-2026-64108, CVE-2026-64109, CVE-2026-64111, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64118, CVE-2026-64121, CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64133, CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64144, CVE-2026-64147, CVE-2026-64148, CVE-2026-64153, CVE-2026-64155, CVE-2026-64163, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168, CVE-2026-64170, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64214, CVE-2026-64217, CVE-2026-64218, CVE-2026-64219, CVE-2026-64220, CVE-2026-64221, CVE-2026-64225, CVE-2026-64231, CVE-2026-64518
Authoritative release date	2026-09-29 07:52:52.214706 UTC
Authority revision date	No separate material revision date is stated by Ubuntu; verified against the first-party notice API.
Affected versions	The Ubuntu releases and source packages enumerated in USN-8729-6: Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy).
Fixed version	Binary packages listed by Canonical; select the matching installed flavor, not every row: jammy: linux-image-6.8.0-1064-aws 6.8.0-1064.67~22.04.1 jammy: linux-image-6.8.0-1064-aws-64k 6.8.0-1064.67~22.04.1 jammy: linux-image-aws 6.8.0-1064.67~22.04.1 jammy: linux-image-aws-6.8 6.8.0-1064.67~22.04.1 jammy: linux-image-aws-64k 6.8.0-1064.67~22.04.1 jammy: linux-image-aws-64k-6.8 6.8.0-1064.67~22.04.1 noble: linux-image-6.8.0-1064-aws 6.8.0-1064.67 noble: linux-image-6.8.0-1064-aws-64k 6.8.0-1064.67 noble: linux-image-aws-6.8 6.8.0-1064.67 noble: linux-image-aws-64k-6.8 6.8.0-1064.67 noble: linux-image-aws-64k-lts-24.04 6.8.0-1064.67 noble: linux-image-aws-lts-24.04 6.8.0-1064.67
CVSS base score	Not provided by the authority
CVSS severity	Not provided by the authority
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

Canonical requires a reboot for this update and warns that the ABI change requires third-party modules to be rebuilt and reinstalled. Standard kernel metapackages normally arrange the matching update, but verify that they remain installed and that any external-module build succeeded. A failed module build can leave storage, networking or another required device unavailable at the next boot.

What To Validate Now

1. Match the instance. Record Ubuntu release, running AWS kernel, installed image/metapackage and external modules. A container shares the host kernel; establish which host must change.
2. Prepare the reboot. Confirm recovery access and workload capacity, preserve the approved recovery state and check the package transaction/module build before rebooting. Do not remove the known recovery kernel merely to make space without a recovery plan.
3. Install and boot the matching image. Use the release-specific security packages below. Reboot in the approved window; a completed package transaction is only the installation stage.
4. Validate the instance. Read back the running kernel and matching installed package version, then test required storage, network connectivity and a representative workload. Return a node to service only after those checks.
5. Close fleet gaps. Record instance/image identifiers, boot evidence and failed or deferred nodes. Update launch images through the normal image pipeline so replacement instances do not silently reintroduce the old build.

Operational Cautions

The listed builds are in Ubuntu's security pocket. Preserve the intended AWS kernel flavor rather than switching to a generic kernel as a shortcut. Test cluster capacity and recovery before a rolling reboot; CVE count and severity alone do not establish exploitation or the exposure of every subsystem on an instance.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• USN-8729-6

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.