Ubuntu Kernel Updates Fix Three Vulnerabilities on Trusty and Xenial
Tech GuruQuick Answer
Ubuntu USN-8864-1 fixes three NFS-server, IPv6 and Netfilter issues in the listed Ubuntu 14.04 and 16.04 kernel streams. Select the host's release and kernel flavour; do not install the entire source-package list. Versioned image packages and their metapackages have different version strings, shown below.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Ubuntu 14.04 ESM and 16.04 ESM Linux kernels, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ubuntu 14.04 ESM and 16.04 ESM Linux kernels |
|---|---|
| Advisory | USN-8864-1 |
| CVEs | CVE-2025-38724, CVE-2026-53131, CVE-2026-53221 |
| Authoritative release date | 2026-10-02 07:04:46.146654 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API |
| Affected versions | The linux, linux-aws, linux-fips, linux-kvm, and linux-lts-xenial source packages and releases enumerated in the notice. |
| Fixed source build (not an install command) | Ubuntu 14.04 ESM: linux-aws 4.4.0-1159.165 / Ubuntu 14.04 ESM: linux-lts-xenial 4.4.0-288.322~14.04.1 / Ubuntu 16.04 ESM: linux 4.4.0-288.322 / Ubuntu 16.04 ESM: linux-aws 4.4.0-1197.212 / Ubuntu 16.04 ESM: linux-fips 4.4.0-1129.136 / Ubuntu 16.04 ESM: linux-kvm 4.4.0-1160.171 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The update covers specified generic/lowlatency, AWS, KVM and FIPS packages, with scope differing by release. The retrieved binary table places most fixes in esm-infra-legacy and the xenial FIPS packages in fips-updates. Repository entitlement and the actual installed flavour determine which update is available.
Fixed Binary Packages
Canonical's notice API lists these visible binary fixes. Match installed packages; this is not an instruction to install every listed package.
- trusty:
linux-image-4.4.0-1159-aws 4.4.0-1159.165;linux-image-4.4.0-288-generic 4.4.0-288.322~14.04.1;linux-image-4.4.0-288-lowlatency 4.4.0-288.322~14.04.1;linux-image-aws 4.4.0.1159.156;linux-image-generic-lts-xenial 4.4.0.288.322~14.04.1;linux-image-lowlatency-lts-xenial 4.4.0.288.322~14.04.1;linux-image-virtual-lts-xenial 4.4.0.288.322~14.04.1. - xenial:
linux-image-4.4.0-1129-fips 4.4.0-1129.136;linux-image-4.4.0-1160-kvm 4.4.0-1160.171;linux-image-4.4.0-1197-aws 4.4.0-1197.212;linux-image-4.4.0-288-generic 4.4.0-288.322;linux-image-4.4.0-288-lowlatency 4.4.0-288.322;linux-image-aws 4.4.0.1197.201;linux-image-fips 4.4.0.1129.131;linux-image-generic 4.4.0.288.294;linux-image-generic-lts-xenial 4.4.0.288.294;linux-image-kvm 4.4.0.1160.157;linux-image-lowlatency 4.4.0.288.294;linux-image-lowlatency-lts-xenial 4.4.0.288.294;linux-image-virtual 4.4.0.288.294;linux-image-virtual-lts-xenial 4.4.0.288.294.
What To Validate Now
- Inventory. Locate Ubuntu 14.04 ESM and 16.04 ESM Linux kernels deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the installed Ubuntu release and binary packages to USN-8864-1. The source build identifies packaging provenance; it is not necessarily an installable package name. Do not transfer a version from another release or assume bundled upstream software is covered.
- Remediate. Confirm access to the applicable legacy ESM or FIPS repository and update the installed kernel image plus its supported metapackage. Keep flavours and release suffixes intact. Rebuild/reinstall affected third-party modules for the ABI change and schedule the required reboot with console or equivalent recovery access.
- Validate. Check the running kernel after reboot, storage and network drivers, and normal NFS/firewall-dependent workloads where used. Record module build/load failures and boot recovery results. Do not consider an old-kernel rollback or a held package a completed fix.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
These are updates for specifically entitled legacy streams, not a reason to postpone a supported-platform migration indefinitely. Keep migration testing separate from this security update, and have the compliance owner approve any FIPS changes. Preserve recovery access before rebooting a remote legacy system.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
