Ubuntu USN-8730-5 Fixes Linux kernel Vulnerability
Tech GuruQuick Answer
USN-8730-5 fixes CVE-2026-53131 in specific Ubuntu kernel flavours: AWS on 20.04 and 22.04, plus AWS FIPS and NVIDIA Tegra IGX on 22.04. It is not a blanket fixed-build statement for every Ubuntu kernel. Install the matching image and reboot.
Confirm Scope And Apply The Supported Fix
What to do now: Record Ubuntu release, running kernel flavour, FIPS entitlement where applicable and required external modules. Choose the corresponding image/metapackage update and schedule the reboot and recovery checks.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ubuntu 20.04 AWS5.15; Ubuntu 22.04 AWS5.15, AWS-FIPS5.15 and NVIDIA Tegra IGX5.15 (including IGX real-time). Only the packages enumerated by USN-8730-5. |
|---|---|
| Advisory | USN-8730-5 |
| CVE | CVE-2026-53131 |
| Authoritative release date | 2026-09-22 (Canonical publication date; no time specified) |
| Authority revision date | No separate USN revision timestamp verified. The former precise imported timestamp is not established as an advisory revision. |
| Affected versions | The USN-listed AWS, AWS-FIPS and NVIDIA Tegra IGX kernel packages on their specified Ubuntu releases before the corresponding fixed image versions. Do not extend these fixed builds to unrelated kernel flavours. |
| Fixed version | Kernel-image versions: 20.04 AWS: 5.15.0-1115.122~20.04.1 (Ubuntu Pro).22.04 AWS, including 64k: 5.15.0-1115.122.22.04 AWS FIPS: 5.15.0-1115.122+fips1 (FIPS Updates).22.04 Tegra IGX and IGX-RT: 5.15.0-1056.56.Metapackage versions differ: Jammy AWS 5.15.0.1115.118, AWS FIPS 5.15.0.1115.111, IGX 5.15.0.1056.58; Focal AWS 5.15.0.1115.122~20.04.1. Match exact binary package names in the USN, not just the source-package label. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | USN-8730-5 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
Canonical identifies IPv6 and Netfilter as the affected subsystems. The update includes distinct AWS, AWS FIPS, IGX and IGX real-time images. Focal AWS fixes require Ubuntu Pro; the Jammy FIPS packages are delivered through FIPS Updates with Ubuntu Pro. Keep those repository and flavour distinctions intact.
What To Validate Now
- Inventory. Locate Linux kernel packages on Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal) deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The Ubuntu releases and packages enumerated in USN-8730-5: Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal). Do not infer applicability from product family or severity alone.
- Remediate. Use the fixed image and metapackage for the installed release/flavour and supported repository. Preserve FIPS Updates entitlement and policy where applicable; rebuild external modules for the new ABI and reboot.
- Validate. Read back the running AWS, AWS-FIPS, IGX or IGX-RT kernel and its installed version after reboot. Test required storage, networking, external modules and device workloads; retain repository and entitlement evidence for FIPS-managed systems.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Canonical requires a reboot after this kernel update and warns of an ABI change. Recompile and reinstall any third-party kernel modules for the new ABI, and verify that this succeeds before relying on them after reboot. Keeping the standard kernel metapackages installed allows the normal upgrade to bring in the new kernel; it is not proof that every external driver rebuilt successfully. Check boot/recovery access, required drivers and rollback before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
