Ubuntu USN-8842-1 Updates NVIDIA Kernels for 18 Vulnerabilities
Tech GuruQuick Answer
USN-8842-1 updates Ubuntu's linux-nvidia kernel flavors for Ubuntu 22.04 and 24.04, including a 24.04 low-latency variant. It is not a standalone NVIDIA graphics-driver or CUDA advisory. Install the matching kernel image, preserve its standard/low-latency and page-size variant, and reboot.
Confirm Scope And Apply The Supported Fix
What to do now: identify the running NVIDIA kernel flavor and external modules, then stage the matching security update. Preserve a supported recovery boot path and validate required compute, storage and network behavior after reboot; successful package installation alone does not establish a working accelerator workload.
Last verified: October 2, 2026 UTC against Canonical's notice and JSON. No NVIDIA system or workload was tested.
Scope And Authority
| Product scope | Linux kernel (NVIDIA) vulnerabilities on Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy) |
|---|---|
| Advisory | USN-8842-1 |
| CVEs | CVE-2026-53131, CVE-2026-53186, CVE-2026-53216, CVE-2026-53221, CVE-2026-53355, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63912, CVE-2026-63922, CVE-2026-63924, CVE-2026-63984, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64000, CVE-2026-64007, CVE-2026-64091 |
| Authoritative release date | 2026-09-29 08:03:31.379086 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8842-1: Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy). |
| Fixed version | Binary packages listed by Canonical; select the matching installed flavor, not every row: jammy: linux-image-6.8.0-1063-nvidia 6.8.0-1063.66~22.04.1jammy: linux-image-6.8.0-1063-nvidia-64k 6.8.0-1063.66~22.04.1jammy: linux-image-nvidia-6.8 6.8.0-1063.66~22.04.1jammy: linux-image-nvidia-64k-6.8 6.8.0-1063.66~22.04.1jammy: linux-image-nvidia-64k-hwe-22.04 6.8.0-1063.66~22.04.1jammy: linux-image-nvidia-hwe-22.04 6.8.0-1063.66~22.04.1noble: linux-image-6.8.0-1063-nvidia 6.8.0-1063.66noble: linux-image-6.8.0-1063-nvidia-64k 6.8.0-1063.66noble: linux-image-6.8.0-1063-nvidia-lowlatency 6.8.0-1063.66.1noble: linux-image-6.8.0-1063-nvidia-lowlatency-64k 6.8.0-1063.66.1noble: linux-image-nvidia 6.8.0-1063.66noble: linux-image-nvidia-6.8 6.8.0-1063.66noble: linux-image-nvidia-64k 6.8.0-1063.66noble: linux-image-nvidia-64k-6.8 6.8.0-1063.66noble: linux-image-nvidia-lowlatency 6.8.0-1063.66.1noble: linux-image-nvidia-lowlatency-6.8 6.8.0-1063.66.1noble: linux-image-nvidia-lowlatency-64k 6.8.0-1063.66.1noble: linux-image-nvidia-lowlatency-64k-6.8 6.8.0-1063.66.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The listed fixes include InfiniBand, network drivers and protocol handling, not only graphics. Canonical requires a reboot and flags an ABI change that requires third-party modules to be rebuilt/reinstalled. Standard metapackages normally arrange matching updates when present; review build failures and module readiness before rebooting an accelerator node.
What To Validate Now
- Match the installed flavor. Record Ubuntu release, standard or low-latency kernel, any 64k variant and installed image/metapackage. Do not replace a low-latency kernel with another flavor merely because a version number looks newer.
- Stage with the workload owner. Drain or pause approved jobs, preserve recovery state and review external-module build results before the boot change.
- Boot the updated kernel. Install from the matching security repository, reboot and read back the running kernel plus installed image version. A driver package or container update alone is not this kernel fix.
- Test required functions. Check accelerator availability, a known-good workload and required network/storage paths. Compare against the deployment's own acceptance criteria; this notice supplies no performance benchmark.
- Keep exceptions visible. Record failed module loads or workload regressions and any fallback to an older kernel as unresolved exposure.
Operational Cautions
The listed kernel builds are in Ubuntu's security pocket. Keep the distinction between kernel, driver and userspace runtime versions in the change record. Do not interpret a successful compute job as proof of every security property, or a security update as evidence that low-latency behavior is unchanged.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
