Ubuntu USN-8801-1 Fixes Linux kernel (Azure CVM) Vulnerabilities
Tech GuruQuick Answer
USN-8801-1 fixes five vulnerabilities in Ubuntu's Azure CVM kernel for 26.04 and 24.04. Use the Azure FDE package for the correct Ubuntu release and reboot. CVE-2026-53362 in this list is known exploited according to CISA KEV; that finding does not extend automatically to the other four CVEs.
Confirm Scope And Apply The Supported Fix
What to do now: Record the Ubuntu release and running azure-fde kernel, verify the VM recovery procedure, and install the corresponding fixed image before rebooting. Include the known-exploited CVE in the exposure/triage review.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Linux kernel (Azure CVM) packages on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble) |
|---|---|
| Advisory | USN-8801-1 |
| CVEs | CVE-2025-10263, CVE-2026-52938, CVE-2026-53325, CVE-2026-53361, CVE-2026-53362 |
| Authoritative release date | 2026-09-22 (Canonical publication date; no time specified) |
| Authority revision date | No separate USN revision timestamp verified. The former precise imported timestamp is not established as an advisory revision. |
| Affected versions | The Ubuntu releases and packages enumerated in USN-8801-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble). |
| Fixed version | Ubuntu 26.04: linux-image-7.0.0-1013-azure-fde, version 7.0.0-1013.13.Ubuntu 24.04: the same image package name with version 7.0.0-1013.13~24.04.1.Use each release's matching Azure FDE metapackages; source-package labels are not interchangeable binary install targets. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Known-exploitation evidence exists for part of this CVE list: CVE-2026-53362: added 2026-08-27, due 2026-08-30. CISA KEV marks forensic triage Yes and ransomware use Unknown for these entries. This does not establish exploitation of every CVE here or compromise of a particular Ubuntu deployment. See the CISA KEV feed. |
What Changed
Canonical describes an Arm TLB permission-revocation issue and fixes in character-device, networking, IPv6 and Unix-socket code. The fixed Azure FDE kernel is 7.0.0-1013.13 on 26.04 and 7.0.0-1013.13~24.04.1 on 24.04. Keep the distribution suffix and confidential-VM flavour intact.
What To Validate Now
- Inventory. Locate Linux kernel (Azure CVM) packages on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble) deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The Ubuntu releases and packages enumerated in USN-8801-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble). Do not infer applicability from product family or severity alone.
- Remediate. Update the installed Azure FDE 7.0 kernel using the correct Ubuntu release repository and version suffix, then reboot through the approved CVM maintenance/recovery process.
- Validate. Verify the running azure-fde release after reboot, required module availability and normal confidential-VM storage/network/application operation. Keep boot and recovery results separate from any incident-triage conclusion.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Canonical requires a reboot after this kernel update and warns of an ABI change. Recompile and reinstall any third-party kernel modules for the new ABI, and verify that this succeeds before relying on them after reboot. Keeping the standard kernel metapackages installed allows the normal upgrade to bring in the new kernel; it is not proof that every external driver rebuilt successfully. Check boot/recovery access, required drivers and rollback before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
