Ubuntu USN-8818-3 Updates Cloud and IoT Kernels for 20 Vulnerabilities
Tech GuruQuick Answer
USN-8818-3 updates four Ubuntu 20.04 kernel lines through Ubuntu Pro: AWS 5.15, Azure 5.15, Azure FDE 5.15 and Intel IoTG 5.15. Preserve the machine's installed flavor and use its own fixed image/metapackage versions. These are host-kernel changes requiring a reboot, not container-only updates.
Confirm Scope And Apply The Supported Fix
What to do now: confirm ESM Infra access, kernel flavor and recovery arrangements. For encrypted Azure guests, include the approved boot/unlock recovery process without exporting secrets; for edge devices, arrange a maintenance state and recovery access before scheduling the reboot.
Last verified: October 2, 2026 UTC against Canonical's notice and JSON. No cloud, encrypted-boot or IoT workflow was tested.
Scope And Authority
| Product scope | Linux kernel vulnerabilities on Ubuntu 20.04 ESM (focal) |
|---|---|
| Advisory | USN-8818-3 |
| CVEs | CVE-2025-10263, CVE-2026-53186, CVE-2026-53216, CVE-2026-53221, CVE-2026-53354, CVE-2026-53355, CVE-2026-53398, CVE-2026-63800, CVE-2026-63808, CVE-2026-63887, CVE-2026-63888, CVE-2026-63912, CVE-2026-63922, CVE-2026-63924, CVE-2026-63984, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64007, CVE-2026-64091 |
| Authoritative release date | 2026-09-29 09:19:25.336946 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8818-3: Ubuntu 20.04 ESM (focal). |
| Fixed version | Binary packages listed by Canonical; select the matching installed flavor, not every row: focal: linux-image-5.15.0-1111-intel-iotg 5.15.0-1111.117~20.04.1focal: linux-image-5.15.0-1116-aws 5.15.0-1116.123~20.04.1focal: linux-image-5.15.0-1121-azure-fde 5.15.0-1121.130~20.04.1focal: linux-image-5.15.0-1122-azure 5.15.0-1122.131~20.04.1focal: linux-image-aws 5.15.0.1116.123~20.04.1focal: linux-image-aws-5.15 5.15.0.1116.123~20.04.1focal: linux-image-azure 5.15.0.1122.131~20.04.1focal: linux-image-azure-5.15 5.15.0.1122.131~20.04.1focal: linux-image-azure-cvm 5.15.0.1122.131~20.04.1focal: linux-image-azure-fde 5.15.0.1121.130~20.04.1focal: linux-image-azure-fde-5.15 5.15.0.1121.130~20.04.1focal: linux-image-intel 5.15.0.1111.117~20.04.1focal: linux-image-intel-iotg 5.15.0.1111.117~20.04.1focal: linux-image-intel-iotg-5.15 5.15.0.1111.117~20.04.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The notice includes an Arm TLB permission-revocation issue and fixes in network, filesystem and related subsystems. Canonical requires a reboot and third-party module rebuild/reinstallation for the changed ABI. Retained standard metapackages normally arrange matching updates, but verify successful package/module builds before rebooting a remotely administered cloud or IoT system.
What To Validate Now
- Match the flavor. Record focal release, AWS/Azure/Azure FDE/Intel IoTG kernel and installed image/metapackage. Do not substitute a plain Azure image for the FDE variant as a shortcut.
- Prepare recovery and maintenance. Confirm entitled repository access, external-module readiness and the approved console/boot recovery path. Coordinate edge-device downtime with the operational owner.
- Install and reboot. Use the matching ESM Infra binary packages below. Keep key material out of change records and avoid altering encryption settings to make a reboot easier.
- Verify the booted system. Read back the running kernel and installed package; check required volumes/unlock behavior, networking and the device or application workflow. Updating a metapackage without booting its image is incomplete.
- Retain specific evidence. Keep flavor, image/metapackage versions and boot/workflow outcomes. Record failed or deferred devices and any rollback exposure separately.
Operational Cautions
These focal builds require the listed Ubuntu Pro/ESM Infra channel. Kernel and metapackage version strings are not interchangeable. Preserve encryption and device-specific configuration, and do not claim an operational check establishes all 20 CVEs are exploitable or unexploitable on that machine.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
