Ubuntu USN-8816-3 Fixes Linux kernel (Oracle) Vulnerabilities
Tech GuruQuick Answer
USN-8816-3 updates Ubuntu 24.04's Oracle-cloud 7.0 kernel packages to 7.0.0-1012.12~24.04.1. Match the installed oracle or oracle-64k flavor, apply its binary-package updates and reboot into the fixed kernel. This is an Ubuntu notice, not an Oracle Linux update, and restarting applications alone does not complete it.
Confirm Scope And Apply The Supported Fix
What to do now: Schedule affected instances and reusable launch images for the matching update. Before rebooting, confirm capacity, recovery-console access and successful builds of any required third-party modules. An image package installed on disk is not evidence that the instance is running it.
Last verified: 2026-10-02 UTC against Canonical's USN JSON, including binary versions and the complete CVE list. No kernel was installed or booted.
Scope And Authority
| Product scope | Linux kernel (Oracle) vulnerabilities on Ubuntu 24.04 LTS (noble) |
|---|---|
| Advisory | USN-8816-3 |
| CVEs | CVE-2026-64530, CVE-2026-64534, CVE-2026-64535, CVE-2026-64541, CVE-2026-64551, CVE-2026-68083, CVE-2026-68457, CVE-2026-68476, CVE-2026-68477, CVE-2026-72014, CVE-2026-72020, CVE-2026-72033, CVE-2026-72041, CVE-2026-72046, CVE-2026-72064, CVE-2026-72065, CVE-2026-72069, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085, CVE-2026-72098, CVE-2026-72129, CVE-2026-72130, CVE-2026-72137, CVE-2026-72139, CVE-2026-72191, CVE-2026-72192, CVE-2026-72194, CVE-2026-72217, CVE-2026-72220, CVE-2026-72221, CVE-2026-72222, CVE-2026-72226, CVE-2026-72234, CVE-2026-72248, CVE-2026-72249, CVE-2026-72251, CVE-2026-72277, CVE-2026-72278, CVE-2026-72279, CVE-2026-72287, CVE-2026-72288, CVE-2026-72289, CVE-2026-72296, CVE-2026-72299, CVE-2026-72317, CVE-2026-72318, CVE-2026-72319, CVE-2026-72320, CVE-2026-72322, CVE-2026-72323, CVE-2026-72329, CVE-2026-72339, CVE-2026-72348, CVE-2026-72351, CVE-2026-72355, CVE-2026-72366, CVE-2026-72381, CVE-2026-72393, CVE-2026-72398, CVE-2026-72399, CVE-2026-72412, CVE-2026-72417, CVE-2026-72422, CVE-2026-72429, CVE-2026-72436, CVE-2026-72442, CVE-2026-72451, CVE-2026-72463, CVE-2026-72466, CVE-2026-72472, CVE-2026-72473, CVE-2026-72477, CVE-2026-72491, CVE-2026-72493, CVE-2026-72494, CVE-2026-72495, CVE-2026-72496, CVE-2026-72501, CVE-2026-74255, CVE-2026-74267, CVE-2026-74268, CVE-2026-74269, CVE-2026-74287, CVE-2026-74310, CVE-2026-74345, CVE-2026-74350, CVE-2026-74361, CVE-2026-74376, CVE-2026-74384, CVE-2026-74394, CVE-2026-74398, CVE-2026-74401, CVE-2026-74406, CVE-2026-74427, CVE-2026-74428, CVE-2026-74433, CVE-2026-74434, CVE-2026-74436, CVE-2026-74439, CVE-2026-80665 |
| Authoritative release date | 2026-09-30 14:04:57.948262 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8816-3: Ubuntu 24.04 LTS (noble). |
| Fixed version | Binary packages listed by Canonical; select the matching installed flavor, not every row: noble: linux-image-7.0.0-1012-oracle 7.0.0-1012.12~24.04.1noble: linux-image-7.0.0-1012-oracle-64k 7.0.0-1012.12~24.04.1noble: linux-image-oracle 7.0.0-1012.12~24.04.1noble: linux-image-oracle-64k 7.0.0-1012.12~24.04.1noble: linux-image-oracle-64k-7.0 7.0.0-1012.12~24.04.1noble: linux-image-oracle-7.0 7.0.0-1012.12~24.04.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The 101-CVE notice spans architecture, storage, filesystem and networking defects. Canonical requires a reboot and warns that the changed kernel ABI requires third-party modules to be rebuilt and reinstalled. Standard kernel metapackages normally arrange matching updates when retained, but inspect the transaction and module-build results before changing the booted kernel.
What To Validate Now
- Match the running kernel. Record Ubuntu release, kernel flavor, architecture and running release. Keep the intended Oracle/Oracle-64k variant; the source-package name is not the binary installation target.
- Prepare boot recovery. Confirm spare capacity, a supported recovery boot path and access independent of the guest's normal network. Identify external storage/network modules that must build successfully before the reboot.
- Apply the matching update. Use the Ubuntu security repository and the image/metapackage versions listed above. Retain the tracking metapackage and review package and module-build failures before proceeding.
- Reboot and read back. Confirm the running release corresponds to the fixed image, then test network reachability, required volumes and the instance workload. A successful package transaction or application restart is insufficient.
- Cover replacements too. Update templates that can launch old kernels and retain instance/image identifiers, before/after kernel evidence and recovery results. A rollback to an older kernel needs an explicit security exception.
Operational Cautions
These noble binaries are in the security pocket, not an ESM-only channel. The advisory's broad subsystem list does not show that every issue is reachable on one instance; match package scope and individual CVE conditions. No instance or exploit test was performed here, and a healthy boot is not proof that every vulnerability was exercised.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
