Generated 2026-08-18 02:02 UTC
12
Immediate action
26
Next maintenance
18
Routine
1,123
Pending evaluation
This assessment identified 4,029 total findings across a single server, with 3 packages affected, resulting in an overall risk rating of High Risk. Of these, 12 findings require immediate remediation (Fix Now) and 26 should be addressed in the near term (Fix Soon), while 1,123 findings remain pending review. The presence of a kernel-level vulnerability affecting core system packages elevates the urgency of remediation, as it poses risk to system stability and potential compromise. Prompt action on the highest-priority items is recommended to reduce exposure.
Effort
25 minutes
Risk reduction
2% of itemized CVSS-weighted risk
1 item, ordered by business impact - patch these first to remove the majority of exploitable risk.
Business impact
An attacker running a malicious file server could crash client machines that connect to it, or potentially corrupt kernel memory leading to further compromise.
Recommended action
Upgrade kernel package and reboot · 25 min
| Server | OS | Total | Immediate | Next maint. | Routine | Pending | Posture |
|---|---|---|---|---|---|---|---|
| kub1 | ubuntu 24.04.4 | 4,029 | 12 | 26 | 18 | 1,123 | High Risk (Large Patch Backlog) |
“Pending evaluation” covers findings the scanner has detected but not yet finished assessing for severity. They are not itemized below until evaluation completes.
CVE-2026-63795
linux-image-6.8.0-134-generic
A remote or local user could crash affected servers or virtual machines that use shared folder/network filesystem features, causing an outage.
Blacklist unused 9p modules now; apply kernel update as soon as a fixed build is published · 25 min
CVE-2026-64303
linux-image-6.8.0-134-generic
On affected embedded hardware, this could allow memory corruption during routine SPI device errors, potentially crashing the device.
Upgrade kernel and reboot · 15 min
No change since the previous scan (2026-08-17) - same findings, no new or resolved items.
New
0
Resolved
0
Effort figures are AI-generated approximations for planning, not guaranteed completion times.
56 of 56 itemized findings
A bug in the kernel's 9p (Plan 9 filesystem protocol) client can free a file handle that's still in use, leading to a use-after-free that can crash the kernel or potentially be leveraged for code execution when a multi-step directory walk over a 9p mount fails partway through.
A remote or local user could crash affected servers or virtual machines that use shared folder/network filesystem features, causing an outage.
Blacklist unused 9p modules now; apply kernel update as soon as a fixed build is published
No patched kernel build currently exists in the 24.04.4 archive for this CVE (it is also present in the newer 6.8.0-137.137 build). Until Canonical publishes a USN with a fixed kernel: 1) Run 'apt update && apt list --upgradable | grep linux-image' periodically or enable unattended-upgrades for the linux-image package so the fix is applied automatically once released; 2) As an interim mitigation, if 9p filesystems (used by QEMU/KVM virtfs shared folders, WSL, or Plan9-style network mounts) are not in use, blacklist the modules: echo 'blacklist 9p' | sudo tee /etc/modprobe.d/blacklist-9p.conf; echo 'blacklist 9pnet' | sudo tee -a /etc/modprobe.d/blacklist-9p.conf; echo 'blacklist 9pnet_virtio' | sudo tee -a /etc/modprobe.d/blacklist-9p.conf; sudo update-initramfs -u; reboot. 3) Once a fixed kernel ships, run 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic' and reboot.
Blacklisting 9p modules will break any VM shared-folder configurations, WSL interop features, or CI runners that rely on 9p/virtfs mounts. Once a real kernel fix is released, the standard kernel upgrade side effects apply: reboot required, DKMS modules (ZFS, VirtualBox, proprietary GPU drivers) must rebuild against the new ABI, and any pinned kernel version in bootloader config will need updating.
CVSS 10.0 is maximum severity, but exploitation requires an active 9p mount (virtfs/WSL), which is uncommon on standard production Linux servers; no fixed kernel is yet available so immediate full remediation isn't possible. Apply the compensating control now and upgrade the kernel the moment a fix ships.
kub1 · 6.8.0-134.134 · Critical
Same 9p client use-after-free as the 134 build: freeing a file handle (fid) that the caller still owns during a failed multi-step directory walk, which can corrupt kernel memory or crash the system.
A remote or local user could crash affected servers or virtual machines that use shared folder/network filesystem features, causing an outage.
Blacklist unused 9p modules now; apply kernel update the moment a fix is released
This is the newest available kernel build and it is still vulnerable -- no upstream fix has landed yet for 24.04.4. Track 'ubuntu.com/security/CVE-2026-63795' or enable unattended-upgrades to pick up the fix automatically. Interim mitigation: blacklist 9p modules if unused: echo -e 'blacklist 9p\nblacklist 9pnet\nblacklist 9pnet_virtio' | sudo tee /etc/modprobe.d/blacklist-9p.conf && sudo update-initramfs -u && sudo reboot. When the fixed kernel is published, run 'sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic' followed by a reboot.
Blacklisting breaks 9p/virtfs shared folders used by some VM guests, WSL interop, and CI systems that mount via 9p. The eventual kernel upgrade requires a reboot and DKMS module rebuilds (ZFS, VirtualBox, Nvidia).
Maximum CVSS score but exploitation is gated on 9p mounts being in active use, which is rare outside VM/dev environments; since no patched kernel exists yet, mitigate via module blacklist and escalate to fix_now once a USN is published.
kub1 · 6.8.0-137.137 · Critical
The Linux SMB client (cifs.ko) can free the same response buffer twice when a SMB2 close request is retried after a replayable error, corrupting kernel memory.
An attacker running a malicious file server could crash client machines that connect to it, or potentially corrupt kernel memory leading to further compromise.
Upgrade kernel package and reboot
Upgrade to the newer kernel build that resolves this (6.8.0-137.137 or later, once confirmed fixed): sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-image-6.8.0-137-generic linux-headers-generic && sudo reboot. Verify with 'uname -r' after reboot.
Requires a reboot, dropping any active SSH sessions and services with in-flight connections. Any DKMS-built modules (ZFS, VirtualBox, proprietary GPU drivers) will rebuild automatically on upgrade but should be verified afterward with 'dkms status'. Any mounted CIFS/SMB shares will be disconnected during reboot and must remount (check /etc/fstab entries with _netdev option).
CVSS 9.8 with the SMB client widely used to mount corporate/network file shares; a malicious or compromised SMB server can trigger this remotely, so treat as urgent if any host mounts external CIFS/SMB shares.
kub1 · 6.8.0-134.134 · Critical
A flaw in the kernel's SCTP protocol handling lets a malicious peer send a crafted ASCONF (address configuration) message that frees a network connection object still in use, leading to use-after-free and complete loss of the SCTP association's transports.
An external attacker could remotely crash or corrupt network services that use the SCTP protocol, causing an outage.
Upgrade kernel and reboot; disable SCTP module if unused
Upgrade the kernel: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; confirm with 'uname -r'. If SCTP is not required, an immediate compensating control is to block the module: echo 'blacklist sctp' | sudo tee /etc/modprobe.d/blacklist-sctp.conf && sudo update-initramfs -u && sudo reboot.
Reboot required; disrupts any active SCTP-based services (telecom signaling, some clustering/HA software, WebRTC data channels using SCTP). Blacklisting sctp will break any application relying on it (e.g., some Kubernetes CNI plugins, telecom SS7/Diameter stacks) until the module is manually loaded.
CVSS 9.8, remotely triggerable by a single crafted packet from any peer able to establish an SCTP association; SCTP is network-facing wherever enabled, so this warrants prompt remediation on any host using it.
kub1 · 6.8.0-134.134 · Critical
The kernel's TLS handshake upcall mechanism (used by kernel-driven TLS negotiation, e.g. for NFS-over-TLS) can retain a stale file reference across a race condition, allowing a socket to be torn down while still referenced, causing a use-after-free.
Could allow disruption or memory corruption of services using kernel-assisted TLS connection setup, potentially leading to a crash or deeper compromise.
Upgrade kernel and reboot
Upgrade the kernel: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Standard kernel-upgrade reboot; DKMS modules rebuild automatically. Any application actively using the net/handshake netlink API (kernel TLS handshake offload, e.g. NFS over TLS with tlshd) will have in-flight handshakes interrupted by the reboot.
CVSS 9.8 but the affected net/handshake feature (used with tlshd/NFS-over-TLS) is not enabled by default on most systems; still needs prompt patching on any host using kernel TLS handshake offload, otherwise it can be bundled with the next scheduled kernel maintenance window.
kub1 · 6.8.0-134.134 · Critical
The Linux SMB client can double-free a response buffer when a query_info() request is retried after a replayable server error, corrupting kernel memory.
A malicious or compromised file server could crash or corrupt memory on client machines that connect to it to browse files.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required, dropping active connections and requiring remount of any CIFS/SMB shares; DKMS modules rebuild automatically but should be spot-checked with 'dkms status'.
CVSS 9.8 and the SMB client is commonly used to access network shares; remotely triggerable by any SMB server the host connects to, so treat urgently on any host that mounts CIFS shares.
kub1 · 6.8.0-134.134 · Critical
The Linux SMB client can double-free a response buffer when a directory change-notify request is retried after a replayable server error, corrupting kernel memory.
A malicious or compromised file server could crash or corrupt memory on client machines watching a network folder for changes.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required, dropping active connections and requiring remount of CIFS/SMB shares that use directory change notifications (common with file-sync clients).
CVSS 9.8, remotely triggerable by any SMB server the client connects to; change-notify is a commonly used SMB feature (file sync tools), so this should be patched promptly.
kub1 · 6.8.0-134.134 · Critical
The Linux SMB client can double-free a response buffer when a flush request is retried after a replayable server error, corrupting kernel memory.
A malicious or compromised file server could crash or corrupt memory on client machines saving files to a network share.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required, dropping active connections; any application writing to and flushing files on mounted SMB shares will need to retry in-flight operations after remount.
CVSS 9.8, remotely triggerable via a malicious SMB server on any host that mounts CIFS/SMB shares; file flush operations are routine, increasing likelihood of exposure.
kub1 · 6.8.0-134.134 · Critical
On systems using the Freescale/NXP LPSPI hardware SPI controller, a DMA setup failure can leave the receive DMA channel still writing to memory that the kernel has already unmapped, corrupting memory.
On affected embedded hardware, this could allow memory corruption during routine SPI device errors, potentially crashing the device.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required. No impact on systems without fsl-lpspi hardware since the driver simply won't load; on affected embedded/ARM boards using this SPI controller, verify SPI-attached peripherals (sensors, flash, displays) reinitialize correctly after reboot.
CVSS 9.8 reflects worst-case impact, but the fsl-lpspi driver only loads on specific NXP i.MX/embedded ARM SoCs with that SPI controller; on typical x86_64 cloud/server instances this hardware and driver are never present, so exposure is effectively zero and this can be bundled into routine patch cycles.
kub1 · 6.8.0-134.134 · Critical
The Linux SMB client can double-free a response buffer when a query-directory (file listing) request is retried after a replayable server error, corrupting kernel memory.
A malicious or compromised file server could crash or corrupt memory on client machines simply browsing a network folder.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required, dropping active connections and requiring remount of CIFS/SMB shares; directory listing operations on network shares will be briefly interrupted.
CVSS 9.8, remotely triggerable via a malicious SMB server, and directory listing is one of the most frequent SMB operations, so exposure is high on any host mounting CIFS shares.
kub1 · 6.8.0-134.134 · Critical
The in-kernel SMB server (ksmbd) is missing permission checks on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation, letting a client overwrite file data on a read-only share or via a handle that should only allow attribute changes, not data writes.
A user connected to an in-kernel SMB file server could bypass read-only or write-restricted permissions and overwrite protected file contents.
Upgrade kernel and reboot; restart ksmbd service if in use
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'. If ksmbd is not in use, confirm it's not loaded/enabled: sudo systemctl status ksmbd 2>/dev/null; lsmod | grep ksmbd; if unused, blacklist it: echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf.
Reboot required; if actively running ksmbd as an SMB file server, briefly disconnects all connected SMB clients during restart. Blacklisting has no effect on hosts that don't run ksmbd.
CVSS 9.8 and directly network-exploitable by any client with SMB access to a ksmbd-served share; this is a real access-control bypass, not just a crash bug, so it should be treated as urgent on any host running ksmbd.
kub1 · 6.8.0-134.134 · Critical
A missing lock around a reference-count increment in the Linux SMB client's session/tree-connection lookup path can cause a race condition leading to memory corruption under concurrent SMB operations.
Could cause instability or crashes on machines that access network file shares under heavy concurrent load.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required, dropping active connections and requiring remount of CIFS/SMB shares.
CVSS 9.8, but exploitation requires winning a race condition during concurrent SMB session/tree operations, making it harder to reliably trigger than the other double-free bugs in this batch; still warrants prompt patching on hosts using CIFS.
kub1 · 6.8.0-134.134 · Critical
The ixgbevf network driver (Intel 10GbE SR-IOV virtual function) can use a socket buffer after it has already been freed while filtering out multicast packets that appear to originate from the VF's own MAC address, corrupting kernel memory in the network receive path.
On systems using Intel SR-IOV network virtualization, a crafted packet on the local network could crash the server or corrupt kernel memory.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'. If hardware uses ixgbevf, confirm the interface reinitializes correctly post-reboot with 'ip link show'.
Reboot required, causing brief network downtime on hosts using Intel SR-IOV virtual function NICs (common in virtualized/cloud environments with passthrough NICs). No impact on systems without ixgbevf hardware.
CVSS 9.8, and while it requires an ixgbevf VF interface to be in use, this is common on virtualized/cloud hosts using SR-IOV, and the trigger is a normal-looking packet on the connected network, making it broadly reachable in those environments.
kub1 · 6.8.0-134.134 · Critical
The Cortina Gemini ethernet driver can mis-track packet fragment counts when the receive ring empties mid-packet, leading to malformed packet assembly and potential memory corruption.
On the specific embedded hardware this driver supports, high network traffic could crash the device or corrupt memory.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'.
Reboot required. No impact on hosts without Cortina Gemini SoC ethernet hardware, which this driver exclusively targets, since the module simply won't be loaded.
CVSS 9.8 reflects worst-case severity, but the cortina driver only applies to legacy Gemini SoC embedded hardware, essentially never present on standard x86_64 servers or cloud VMs, so real-world exposure is negligible and this can be handled in the next routine kernel maintenance cycle.
kub1 · 6.8.0-134.134 · Critical
The netfilter SYNPROXY module (used to protect against SYN flood attacks) can use a stale pointer to the TCP header after the kernel reallocates packet memory, leading to a write into freed memory or a corrupted checksum on outgoing packets.
On firewalls or load balancers using SYN flood protection, a remote attacker could crash the firewall or send packets with corrupted checksums, potentially bypassing protections.
Upgrade kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot; verify with 'uname -r'. If SYNPROXY is in use, check active rules with 'sudo iptables -t raw -L' / 'nft list ruleset | grep -i synproxy' and re-verify functioning after reboot.
Reboot required, briefly interrupting firewall/connection tracking state and any in-flight connections. Hosts not using the SYNPROXY netfilter target are unaffected functionally by the fix.
CVSS 9.8, remotely triggerable by any attacker sending TCP traffic to a host using the SYNPROXY target, which is deployed specifically to face hostile internet traffic (SYN flood mitigation), making this a high-priority, directly network-exposed fix.
kub1 · 6.8.0-134.134 · Critical
The kernel's HSR (High-availability Seamless Redundancy) network driver does not fully validate the length of supervision-frame TLV headers before reading them, so a truncated or malformed HSR frame can trigger an out-of-bounds memory read and crash the host.
An attacker on a network segment using the HSR industrial redundancy protocol could crash the server, causing an outage.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic (or 'sudo apt install linux-generic' once Canonical ships the build containing this fix), then sudo update-grub && sudo reboot. After reboot confirm with 'uname -r' and 'apt changelog linux-image-generic | grep -i CVE-2026-64000'.
Requires a full reboot causing brief downtime; any DKMS-built out-of-tree modules (ZFS, NVIDIA, VirtualBox) must be rebuilt against the new kernel ABI - run 'sudo dkms autoinstall' after reboot and verify with 'dkms status'; confirm GRUB default entry points at the new kernel image.
CVSS 9.8, but HSR is a niche industrial-Ethernet redundancy protocol rarely enabled on general-purpose Ubuntu servers; unless this host actively participates in an HSR ring, remote exposure is unlikely, so schedule at the next maintenance window rather than as an emergency change.
kub1 · 6.8.0-134.134 · Critical
A use-after-free exists in the kernel's ICMP-over-tunnel PMTU handling for IP-in-IP/GRE tunnels: pointers to packet header data are cached before a buffer reallocation, so a crafted oversized packet can cause the kernel to access freed memory.
Could let an attacker crash or potentially take control of a server that terminates network tunnels, causing an outage or worse.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify with 'uname -r' and check the changelog for CVE-2026-63994.
Reboot required, causing a short outage; active tunnel sessions (GRE/IPIP) will drop and re-establish after reboot; DKMS modules need rebuilding via 'sudo dkms autoinstall'.
CVSS 9.8 remote, unauthenticated use-after-free reachable by any host that processes tunneled traffic (GRE/IPIP), a common configuration on routers, VPN endpoints, and cloud gateways - patch during the next available window without delay.
kub1 · 6.8.0-134.134 · Critical
The kernel's VXLAN driver reuses a stale IP-header pointer after a function that can reallocate the packet buffer, creating a use-after-free that a crafted VXLAN packet can trigger.
An attacker sending crafted overlay-network traffic could crash or potentially compromise a server used for cloud or container networking.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify kernel version and changelog entry for CVE-2026-63993 post-reboot.
Reboot required; VXLAN overlay interfaces (e.g. Kubernetes Calico/Flannel VXLAN backend, Open vSwitch) will briefly drop connectivity during the reboot; DKMS modules must rebuild.
CVSS 9.8 remote use-after-free; VXLAN is widely used for cloud and container overlay networking, making this broadly exploitable wherever VXLAN endpoints process untrusted traffic - treat as urgent.
kub1 · 6.8.0-134.134 · Critical
An integer-truncation bug in the kernel's IPv6 RPL (Routing Protocol for Low-power networks) header decompression code allows a crafted routing header to overlap and corrupt the memory region used for the decompressed packet when it is forwarded.
Could allow an attacker to corrupt network packets being forwarded by the server, potentially crashing it or affecting traffic integrity.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot; confirm fix via changelog reference to CVE-2026-63984.
Reboot required causing brief downtime; no config migration needed; DKMS modules must rebuild for the new kernel ABI.
CVSS 9.8, but RPL (RFC 6550) is used only in specialized low-power/IoT mesh routing deployments and is not enabled by default on standard Ubuntu servers - schedule for the next routine patch cycle unless this host performs IPv6 RPL routing.
kub1 · 6.8.0-134.134 · Critical
A reversed linked-list splice in the kernel's in-kernel TLS 'handshake' upcall subsystem prevents pending handshake requests from being torn down when a network namespace is destroyed, causing reference-count corruption and a use-after-free race with request cancellation.
Could allow crashes or memory corruption on systems that use containers or namespaces together with in-kernel TLS, potentially destabilizing the host.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify with 'uname -r' and check for CVE-2026-63978 in the changelog.
Reboot required; hosts running many containers/network namespaces (Docker, Kubernetes) will have networking restart cleanly post-reboot; no persistent config changes needed.
CVSS 9.8, but the flaw requires network-namespace teardown races combined with kernel TLS (ktls) or NFS-over-TLS usage, a fairly specific configuration rather than a directly internet-facing service - patch at the next maintenance window.
kub1 · 6.8.0-134.134 · Critical
A flaw in the netfilter conntrack code allows a network-connected attacker to infer OpenVPN tunnel endpoint information, which could aid further reconnaissance or targeted attacks.
Could let an outside attacker learn details about your VPN connections, helping them plan more targeted network attacks.
Upgrade kernel past the current build and verify VPN services reconnect after reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic linux-generic; sudo reboot; verify with uname -r that the running build is newer than 6.8.0-137; then sudo apt purge linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic.
Reboot causes brief downtime; active VPN tunnels (OpenVPN, WireGuard, IPSec) on this host will drop and must re-establish after reboot; conntrack state table is reset, so existing long-lived connections through this box will need to renegotiate.
This is fundamentally an information-disclosure issue about connection metadata, not remote code execution, despite the 9.8 score carried in this feed; it should be handled in the next scheduled patch cycle unless this host terminates high-value OpenVPN tunnels where endpoint exposure is especially sensitive.
kub1 · 6.8.0-134.134 · Critical
The kernel's iSCSI target CHAP authentication code fails to validate the length of a base64-encoded CHAP response before decoding it, letting a remote iSCSI initiator overflow a kernel heap buffer by up to 79 bytes during the login exchange.
A remote attacker could crash or potentially gain code execution on a storage server exposing an iSCSI target, without needing valid credentials.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Coordinate with storage clients before rebooting; verify fix via changelog reference to CVE-2026-63886.
Reboot required; if this host runs an iSCSI target (LIO/targetcli), all active iSCSI sessions will disconnect during the reboot and initiators must reconnect - schedule during a storage maintenance window.
CVSS 9.8 heap overflow reachable during the pre/partial-authentication CHAP exchange of an exposed iSCSI target; if this server runs targetcli/LIO, the flaw is remotely triggerable by any client that can reach the iSCSI port, so treat as urgent.
kub1 · 6.8.0-134.134 · Critical
The in-kernel SMB server's RDMA (SMB Direct) transport can free send buffers that still have unsignaled, in-flight completions, creating a race condition in completion handling that can crash the server or corrupt memory.
Could crash a file server that uses high-speed SMB-over-RDMA networking, causing a service outage.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify with 'uname -r' and changelog reference to CVE-2026-31536.
Reboot required; only affects hosts running the in-kernel ksmbd server with RDMA-capable NICs (RoCE/iWARP) and SMB Direct enabled - SMB-over-RDMA sessions will drop and must reconnect after reboot.
CVSS 9.8, but exploitability is limited to hosts running ksmbd with SMB Direct/RDMA enabled, an uncommon configuration requiring specialized NIC hardware - patch at the next maintenance window unless SMB Direct is in active use.
kub1 · 6.8.0-134.134 · Critical
The kernel's exFAT filesystem driver can dereference a buffer pointer after the underlying buffer has already been released (use-after-free), which can be triggered by mounting a specially crafted exFAT filesystem, such as from a malicious USB drive.
Could crash the system or leak sensitive memory contents if a user mounts a malicious exFAT-formatted USB drive or disk image.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify with changelog reference to CVE-2026-63808.
Reboot required; no other operational impact expected beyond standard kernel upgrade side effects (DKMS module rebuilds).
Requires an attacker to get a crafted exFAT filesystem mounted (e.g. via removable media), a local/physical attack vector rather than remote network exploitation, so despite the 9.8 CVSS score real-world exposure is lower unless untrusted USB media is routinely mounted on this host.
kub1 · 6.8.0-134.134 · Critical
A signed/unsigned integer mix-up in the B.A.T.M.A.N. Advanced mesh-networking driver's translation-table code can cause a length field to wrap negative, resulting in a buffer being sent that is under-filled and leaks uninitialized kernel memory to other mesh nodes.
Could leak fragments of kernel memory to other nodes on a mesh network the server participates in.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Verify with changelog reference to CVE-2026-64089.
Reboot required; only relevant to hosts with the batman-adv module loaded and mesh interfaces configured.
The batman-adv mesh-networking module is not loaded or used on typical Ubuntu server deployments, and the real-world impact is an uninitialized-memory information leak (not a crash or RCE) limited to that protocol - defer until the next scheduled kernel update unless this host runs a batman-adv mesh.
kub1 · 6.8.0-134.134 · Critical
The io_ti USB-serial driver trusts a device-supplied length field when copying EEPROM data into a fixed 10-byte kernel buffer, so a malicious USB-to-serial adapter can overflow the buffer by up to roughly 16KB.
A malicious USB serial device plugged into the machine could corrupt kernel memory and potentially take control of the system.
Update kernel package (or blacklist io_ti driver if unused) and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. If io_ti/edgeport USB-serial adapters are not used, an interim mitigation is 'echo blacklist io_ti | sudo tee /etc/modprobe.d/blacklist-io-ti.conf' and 'sudo modprobe -r io_ti' until the reboot can be scheduled.
Reboot required for the full fix; blacklisting the driver as an interim step will break any legitimate Edgeport/io_ti USB serial adapters until re-enabled.
CVSS 6.8 requires physical access to plug in a malicious USB-to-serial adapter, a low-likelihood attack path on most servers - schedule with routine patching unless the host has exposed or unsupervised USB ports.
kub1 · 6.8.0-134.134 · Medium
The io_ti USB-serial driver trusts a device-supplied length field when copying EEPROM data into a fixed 10-byte kernel buffer, so a malicious USB-to-serial adapter can overflow the buffer by up to roughly 16KB.
A malicious USB serial device plugged into the machine could corrupt kernel memory and potentially take control of the system.
Update kernel package (or blacklist io_ti driver if unused) and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-137-generic linux-headers-6.8.0-137-generic linux-modules-extra-6.8.0-137-generic, then sudo update-grub && sudo reboot. If io_ti/edgeport USB-serial adapters are not used, an interim mitigation is 'echo blacklist io_ti | sudo tee /etc/modprobe.d/blacklist-io-ti.conf' and 'sudo modprobe -r io_ti'.
Reboot required for the full fix; blacklisting the driver as an interim step will break any legitimate Edgeport/io_ti USB serial adapters until re-enabled.
CVSS 6.8 requires physical access to plug in a malicious USB-to-serial adapter, a low-likelihood attack path on most servers - schedule with routine patching unless the host has exposed or unsupervised USB ports.
kub1 · 6.8.0-137.137 · Medium
The NVMe driver failed to validate that a user-supplied metadata buffer size matched the DMA transfer size, letting a privileged local user cause the NVMe device to DMA more data than the buffer could hold, overwriting adjacent kernel memory.
A user who already has elevated (root/admin) access to the server could crash it or corrupt data using a malicious NVMe command, but they'd need that access already.
Include in routine kernel patch cycle
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic; sudo apt autoremove --purge linux-image-6.8.0-134-generic; sudo reboot; confirm with 'uname -r'.
Reboot required; DKMS rebuild risk for third-party modules; no impact on NVMe device data or partitions.
CVSS 6.7 Medium and exploitation requires a privileged local user with direct NVMe device access - this is a privilege-escalation-adjacent bug, not remotely exploitable, so it can be bundled with the next scheduled maintenance window rather than treated as urgent.
kub1 · 6.8.0-134.134 · Medium
The kernel's traffic-control 'pedit' packet-editing action computed the copy-on-write range for a packet once before applying all edits, so certain typed-key edits could write past the copied region into shared page-cache memory, corrupting it.
Could allow corruption of network packet memory on systems using advanced traffic-shaping rules, potentially crashing the box or corrupting data.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. After reboot, re-verify any tc pedit rules with 'tc qdisc show' and 'tc filter show' to confirm they reapplied correctly.
Reboot required; if tc pedit rules are applied via boot scripts or netplan hooks, confirm they reapply cleanly post-reboot.
CVSS 6.7; triggering requires CAP_NET_ADMIN privilege to configure a tc pedit action, typically restricted to administrators, which limits remote unauthenticated exploitability - patch during the next scheduled maintenance window.
kub1 · 6.8.0-134.134 · Medium
Same NVMe driver metadata-buffer size validation gap still present in the 137 kernel build, allowing a privileged local user to trigger DMA overwrite of adjacent kernel memory.
A user who already has elevated (root/admin) access to the server could crash it or corrupt data using a malicious NVMe command.
Include in routine kernel patch cycle
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic; sudo apt autoremove --purge linux-image-6.8.0-137-generic; sudo reboot; confirm with 'uname -r'.
Reboot required; DKMS rebuild risk for third-party modules; no impact on stored NVMe data.
CVSS 6.7 Medium, requires an already-privileged local attacker with NVMe device access; low incremental risk, safe to bundle with next patch cycle.
kub1 · 6.8.0-137.137 · Medium
This finding is tagged against the kernel package, but the actual vulnerable component is the userspace rpc.mountd daemon (nfs-utils): an NFSv3 client can access any subdirectory of an exported tree, bypassing the permissions and root_squash/all_squash restrictions defined in /etc/exports.
A client with NFS access to one folder could improperly gain access to other folders on the same NFS export, potentially reading or writing files they shouldn't be able to reach.
Update nfs-utils package (not the kernel) and restart NFS services
This is not fixed by a kernel update - patch the nfs-utils package instead: sudo apt update && sudo apt install --only-upgrade nfs-utils; sudo systemctl restart nfs-kernel-server rpcbind; verify the fixed rpc.mountd version with 'dpkg -l nfs-utils'. Also review /etc/exports to ensure subtree_check is enabled where feasible as defense-in-depth.
Restarting nfs-kernel-server/rpcbind briefly drops active NFS mounts on connected clients, which will need to remount (usually automatic for 'hard' mounts, may hang until the service is back). No kernel reboot is required for this specific fix.
CVSS 6.5 Medium and network-reachable by any NFSv3 client that already has some export access - real risk depends on whether this host runs an NFS server; if nfs-kernel-server is active this should be patched promptly, otherwise it can wait, but note the package tagging here is likely mismatched (kernel vs nfs-utils) and should be corrected in the finding itself.
kub1 · 6.8.0-134.134 · Medium
An old, still-unresolved Xen hypervisor issue where a malicious guest VM can read leftover uninitialized host kernel memory because certain PCI memory/IO decoding bits aren't properly enabled - this only matters if this machine is a Xen dom0 host or a Xen-based hypervisor.
On a non-Xen server this poses no risk; on a Xen hypervisor host, a malicious guest VM could potentially read fragments of sensitive host memory.
Confirm Xen role; patch only if this host runs Xen
1) Determine if this system is a Xen host: 'xl info' or check for '/proc/xen'. If this is a KVM/bare-metal Ubuntu server (the common case), this CVE has no applicable attack surface. 2) If it IS a Xen host, update to the latest kernel and Xen hypervisor packages: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic xen-hypervisor-4.17-amd64' then 'sudo reboot'.
If applicable and patched, a full host reboot is required, which will bring down all guest VMs on that Xen host during the maintenance window - plan guest migration or scheduled downtime first.
CVSS 6.5 information-disclosure but the attack surface only exists on Xen dom0/hypervisor hosts; on a standard non-Xen Ubuntu server this is not exploitable and can be deferred indefinitely.
kub1 · 6.8.0-134.134 · Medium
Known as the 'Marvin' attack, this is a timing side-channel in the kernel's RSA PKCS#1v1.5 decryption path that could theoretically let a network attacker recover plaintext or forge signatures by measuring tiny timing differences over many repeated requests against a service using kernel-based RSA decryption (e.g., in-kernel TLS or crypto API consumers).
An attacker on the network could, in theory and with substantial effort, extract cryptographic keys used for RSA decryption on this server.
Update kernel to patched build and reboot
Update to a kernel build containing the constant-time RSA decryption fix: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic' (or better, move to the current -137 kernel meta-package: 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic'), then 'sudo reboot' and confirm with 'uname -r'.
Requires a reboot and brief downtime; any custom kernel modules built via DKMS will need to be rebuilt against the new kernel headers, and any application pinned to this exact kernel ABI version should be re-tested.
CVSS 6.5 but exploitation requires a very large number of precisely timed network requests against an in-kernel RSA decryption consumer, making practical exploitation difficult; still worth fixing in the next patch cycle since it affects confidentiality of private keys.
kub1 · 6.8.0-134.134 · Medium
This is a Wi-Fi driver/spec issue (part of the 'FragAttacks' family) where WEP/WPA/WPA2/WPA3 implementations accept fragmented plaintext frames on a protected network, letting a nearby attacker inject arbitrary data frames.
An attacker within Wi-Fi range could inject fake network traffic into what should be an encrypted, protected wireless network.
Update kernel and Wi-Fi firmware
sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic; sudo apt autoremove --purge linux-image-6.8.0-134-generic; sudo reboot; confirm with 'uname -r'. If this server has a Wi-Fi NIC in active use, also ensure the wireless driver/firmware (e.g., iwlwifi, ath9k, mt76) is updated via 'sudo apt install --only-upgrade linux-firmware'.
Reboot required. Firmware update for wireless chipsets may briefly drop any active Wi-Fi association during the next network-manager restart.
CVSS 6.5 Medium, requires an attacker in physical Wi-Fi range and only matters on hosts actually using Wi-Fi networking (most servers use wired Ethernet) - safe to defer to routine patching unless this host relies on Wi-Fi.
kub1 · 6.8.0-134.134 · Medium
This CVE describes a Wi-Fi frame-injection flaw (accepting plaintext frames on an encrypted WPA/WPA2/WPA3 link) in a specific ALFA-brand Windows 10 USB Wi-Fi adapter driver, not in the mainline Linux wireless stack. It is very unlikely to apply to this kernel unless the host is actually running that specific Windows driver under some compatibility layer, which is not how in-tree Linux Wi-Fi drivers work.
Negligible risk to this server because the flaw is in a Windows driver for a specific USB Wi-Fi dongle, not in the software actually running here.
Verify non-applicability and close as false positive; no kernel-specific fix exists for this CVE
1) Confirm applicability first: run 'lspci -k' / 'lsusb' and check if an ALFA AWUS036H adapter with a Windows driver stack (e.g., via NDISwrapper) is in use - this is extremely rare on a standard Ubuntu server. 2) If confirmed not applicable, document as a false-positive/non-applicable finding in your vulnerability tracker. 3) If you do want to stay current regardless, update the kernel anyway: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic' then 'sudo reboot'.
If you proceed with a kernel update purely for hygiene, expect a full reboot, a short service interruption, and the need to rebuild any DKMS modules (e.g., NVIDIA, ZFS, VirtualBox) against the new kernel headers.
CVSS 6.5 but the vulnerable component (ALFA Windows driver) is not part of this Linux kernel build; on a server without that specific USB adapter and Windows driver stack there is no exploitable attack surface, so this can be deferred pending confirmation.
kub1 · 6.8.0-134.134 · Medium
A use-after-free in the in-kernel KSMBD (SMB3 server) implementation's setup_async_work function lets a remote SMB client trigger a crash by causing the kernel to access already-freed work-item memory.
If this server shares files over SMB using the in-kernel server, a remote client could crash the file-sharing service, causing an outage.
Patch kernel; prioritize if ksmbd/in-kernel SMB server is enabled
First check exposure: 'lsmod | grep ksmbd' and 'systemctl status ksmbd' - if the module isn't loaded/service isn't running, no action needed beyond the routine kernel update. If ksmbd is in use: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic; sudo apt autoremove --purge linux-image-6.8.0-134-generic; sudo systemctl restart ksmbd (if applicable) or sudo reboot; confirm with 'uname -r'.
Reboot required for the kernel fix, briefly dropping any active SMB sessions served by ksmbd. DKMS rebuild risk for third-party modules unrelated to ksmbd.
CVSS 6.5 Medium, network-reachable if ksmbd is enabled (it is not the default SMB server on Ubuntu, which normally uses userspace Samba), so exposure depends entirely on whether ksmbd is actively running - confirm and patch promptly if so, otherwise low priority.
kub1 · 6.8.0-134.134 · Medium
The kernel's iSER (iSCSI-over-RDMA) target computes the login-request payload length by subtracting a fixed header size without checking for underflow; a too-short login packet from a remote initiator produces a negative length that is later used as a memcpy size, crashing the target.
A remote, unauthenticated attacker could crash a storage server exposing an iSER target simply by sending an undersized login packet.
Update kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic linux-headers-6.8.0-134-generic linux-modules-extra-6.8.0-134-generic, then sudo update-grub && sudo reboot. Coordinate with storage clients before rebooting if the isert target module is loaded.
Reboot required; iSER/iSCSI-over-RDMA sessions will disconnect during reboot and require reconnection; only relevant if this host has RDMA-capable NICs (InfiniBand/RoCE) and the isert target module loaded.
CVSS 6.5 denial-of-service only, no code execution demonstrated; pre-authentication remote trigger but limited to hosts running the iSER/RDMA iSCSI target - patch promptly if this server exposes an iSER target, otherwise schedule with routine maintenance.
kub1 · 6.8.0-134.134 · Medium
This describes a privilege-escalation flaw in the nfs-utils rpc.mountd daemon (userspace NFS server component), not in the Linux kernel image itself - an NFSv3 client can access subdirectories beyond what root_squash/all_squash restrictions should allow.
An NFS client could gain unauthorized access to files outside its permitted export directory, bypassing access restrictions.
Update nfs-utils package and restart the NFS server (not a kernel-level fix)
1) Confirm whether this host runs an NFS server: 'systemctl status nfs-server' and check '/etc/exports'. 2) The actual fix is to update nfs-utils, not the kernel: 'sudo apt update && sudo apt install --only-upgrade nfs-kernel-server nfs-common' then 'sudo systemctl restart nfs-server'. 3) As an interim mitigation, tighten '/etc/exports' to use 'subtree_check' and restrict export scope, then 'sudo exportfs -ra'.
Restarting nfs-server briefly disconnects active NFS client mounts, which may cause client-side I/O errors or hangs on files open at restart time; review exports carefully to avoid inadvertently locking out legitimate clients.
CVSS 6.5 privilege escalation on exported NFS shares; this only matters if the host actually exports NFSv3 shares, but where it does the impact (bypassing root_squash) is significant enough to fix in the near term rather than defer.
kub1 · 6.8.0-137.137 · Medium
Same as reported for the -134 kernel: this CVE concerns a plaintext-frame-injection flaw in a specific ALFA Windows 10 Wi-Fi driver, not the mainline Linux wireless stack used by this kernel.
Negligible risk to this server; the vulnerable component is a Windows Wi-Fi adapter driver, not software running here.
Verify non-applicability and close as false positive
1) Verify no ALFA AWUS036H hardware with a Windows driver compatibility layer is in use via 'lsusb'. 2) Mark as non-applicable if confirmed. 3) If pursuing general kernel currency, run 'sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic' then 'sudo reboot'.
A general kernel update triggers a reboot, brief service downtime, and possible DKMS rebuilds for third-party kernel modules.
Identical rationale to the -134 kernel instance: the vulnerable component is unrelated third-party Windows driver code, so this poses no real risk to this Linux server and can be deferred.
kub1 · 6.8.0-137.137 · Medium
A use-after-free bug in the in-kernel SMB server (KSMBD) can be triggered remotely by a connecting SMB client to crash the kernel by accessing already-freed work-queue memory, resulting in a denial of service.
A remote attacker connecting to an in-kernel SMB file-sharing service could crash the server, causing an outage.
Disable ksmbd if unused, or update kernel if ksmbd is the SMB server in use
1) Check if ksmbd is even loaded/active: 'lsmod | grep ksmbd' and 'systemctl status ksmbd'. Most Ubuntu 24.04 servers do not run ksmbd (Samba's userspace daemon is used instead). 2) If ksmbd is not in use, disable and blacklist it: 'sudo modprobe -r ksmbd; echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf'. 3) If ksmbd IS your SMB server, update the kernel to the latest available point release: 'sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic' then 'sudo reboot'.
Blacklisting ksmbd will break any file sharing that depends on it (rare); a kernel update requires a reboot and DKMS module rebuilds for any third-party drivers.
CVSS 6.5 remote DoS; ksmbd is not enabled by default on most Ubuntu installs so exposure is likely limited, but if the module is loaded and reachable over the network this should be addressed promptly since it requires no authentication to trigger a crash.
kub1 · 6.8.0-137.137 · Medium
This describes a Wi-Fi fragmentation-based frame injection flaw in a specific ALFA AWUS036ACH USB adapter's Windows 10 driver, not in the standard Linux wireless stack - it is unlikely to be relevant to this server's kernel.
Negligible risk to this server since the flaw is in a Windows driver for a specific USB Wi-Fi adapter, not software actually deployed here.
Verify non-applicability and close as false positive
1) Confirm applicability: check for an ALFA AWUS036ACH adapter and any Windows-driver compatibility layer via 'lsusb' - this is very rare on a Linux server. 2) Document as non-applicable if no such hardware/driver stack exists. 3) If you want general kernel hygiene, apply the latest kernel updates: 'sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic' then 'sudo reboot'.
If a general kernel update is applied for hygiene, expect a reboot, brief downtime, and DKMS module rebuilds for third-party drivers.
CVSS 6.5 but the vulnerable component is a third-party Windows Wi-Fi driver unrelated to this Linux kernel; without that specific hardware present there is no exploitable path, so it can be safely deferred.
kub1 · 6.8.0-137.137 · Medium
The 'Marvin' RSA timing side-channel affecting kernel-based RSA decryption is still flagged on this newer -137 kernel build, indicating the fully hardened version has not yet landed in this Ubuntu point release.
An attacker on the network could, with significant effort, attempt to extract RSA private key material used for decryption on this server.
Monitor for and apply the next Ubuntu kernel security update covering this CVE
Check for a newer kernel point release beyond 6.8.0-137: 'sudo apt update && sudo apt list --upgradable | grep linux-image'. If a newer version is available, install it with 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic' and 'sudo reboot'. If none is yet published, monitor Ubuntu Security Notices (USN) for this kernel series and re-scan after the next SRU cycle.
When the fix does land, applying it requires a reboot, brief downtime, and DKMS rebuilds for out-of-tree modules; until then there is no local mitigation beyond limiting network exposure of services relying on kernel RSA decryption.
CVSS 6.5 but requires many precisely-timed network measurements to exploit in practice, and no fixed kernel build is confirmed available yet on this branch; track and apply as soon as Ubuntu ships the patched kernel.
kub1 · 6.8.0-137.137 · Medium
Same Xen dom0 information-disclosure issue as reported against the -134 kernel: relevant only if this host is a Xen hypervisor allowing a malicious guest to read uninitialized host memory.
No risk on a non-Xen server; on a Xen hypervisor, a malicious guest could read fragments of host memory.
Confirm Xen role; patch only if applicable
1) Confirm Xen role with 'xl info' or checking for '/proc/xen'. 2) If not a Xen host (typical for a standard Ubuntu server), no action is required for this CVE. 3) If it is a Xen host, update kernel and Xen packages: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-137-generic xen-hypervisor-4.17-amd64' then 'sudo reboot'.
On a Xen host, patching requires a full reboot which takes down all hosted guest VMs during the maintenance window; plan guest migration beforehand.
Same as the -134 instance: this attack surface only exists on Xen dom0/hypervisor configurations, which is not the typical deployment for this kernel package, so it can be deferred pending confirmation.
kub1 · 6.8.0-137.137 · Medium
A race condition in the PCMCIA smart-card reader driver (scr24x_cs) can cause a use-after-free if someone with physical access yanks the PCMCIA card while a program has it open, potentially crashing the kernel or corrupting memory.
Requires an attacker to have physical hands-on access to legacy PCMCIA hardware attached to this machine, which is very unlikely for a data-center server.
Blacklist the unused scr24x_cs module
1) Check if PCMCIA hardware is even present: 'lspci | grep -i pcmcia' and 'lsmod | grep scr24x'. This driver is almost never loaded on modern servers/VMs. 2) If unused, blacklist it: 'echo "blacklist scr24x_cs" | sudo tee /etc/modprobe.d/blacklist-scr24x.conf' and 'sudo modprobe -r scr24x_cs' if loaded. 3) If genuinely in use (legacy hardware with PCMCIA smart-card readers), update the kernel: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-134-generic' then 'sudo reboot'.
Blacklisting the module has no impact unless you actually use a PCMCIA smart-card reader; a kernel update requires reboot and DKMS rebuilds.
CVSS 6.4 but requires physical proximity and specific legacy PCMCIA hardware that is essentially never present in modern server/VM deployments, making real-world exploitability effectively nil.
kub1 · 6.8.0-134.134 · Medium
A race condition in the kernel's UDP SO_REUSEPORT classic-BPF filter handling can free the packet filter while another CPU is still using it to select a socket, causing a use-after-free read (KASAN vmalloc-out-of-bounds) during packet delivery.
A local process or user racing socket configuration changes could crash the server, causing a service outage.
Monitor for Ubuntu kernel update and apply when released
No fixed Ubuntu kernel package currently addresses this CVE (condition evaluates as 'default status', meaning it applies regardless of installed version). Check for an updated package with: sudo apt update && apt-cache policy linux-image-generic. Until Canonical publishes a USN with a patched 6.8.0-13x build, there is no version to install; track https://ubuntu.com/security/CVE-2026-52910 and apply the kernel update via 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot' as soon as it is released.
None applicable yet since no patch is available to apply; once released, the kernel upgrade will require a reboot and any out-of-tree DKMS modules (ZFS, NVIDIA, VirtualBox) will need to rebuild against the new kernel ABI.
CVSS 6.4 with the trigger requiring local socket manipulation (replacing a reuseport BPF filter while packets are in flight) rather than remote network exploitation; no fix is currently shippable, so track and apply once Canonical backports it rather than taking ad-hoc action now.
kub1 · 6.8.0-134.134 · Medium
A use-after-free can occur when a BPF sockmap iterator program updates an AF_UNIX socket's protocol ops at the same time the peer socket is closing, because the peer pointer can go stale mid-update.
Could allow a privileged local process to crash the server or corrupt kernel memory while managing network socket monitoring tools.
Update kernel to 6.8.0-136.136 and reboot
Upgrade to the fixed kernel and reboot: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic linux-image-6.8.0-136-generic linux-headers-6.8.0-136-generic && sudo reboot. Confirm the running kernel afterward with 'uname -r' (expect 6.8.0-136-generic or later).
Reboot required, causing a brief service interruption; any DKMS-built kernel modules (ZFS, NVIDIA, VirtualBox, WireGuard-dkms) will rebuild automatically on upgrade but should be verified with 'dkms status' post-reboot; old kernel package can be left installed as a fallback boot option until stability is confirmed.
CVSS 6.4, requires CAP_BPF/CAP_SYS_ADMIN to load the triggering BPF iterator program so it is not remotely exploitable, but the fix is a simple already-available kernel bump; apply in the next patch window rather than waiting for a full maintenance cycle.
kub1 · 6.8.0-134.134 · Medium
The open-coded BPF task_vma iterator reads a task's mm_struct without taking a reference, so if the task exits while the iterator runs, the memory descriptor can be freed underneath it, causing a use-after-free.
Could let a process with BPF tracing privileges crash the server or read stale memory while inspecting other processes' memory maps.
Update kernel to 6.8.0-136.136 and reboot
Upgrade to the fixed kernel and reboot: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic linux-image-6.8.0-136-generic linux-headers-6.8.0-136-generic && sudo reboot. Verify with 'uname -r'.
Reboot required; DKMS modules rebuild automatically but should be checked with 'dkms status'; no configuration migration needed since this is purely a kernel binary update.
CVSS 6.4 and exploitation requires CAP_BPF/CAP_SYS_ADMIN to run the triggering iterator program, limiting it to already-privileged local users; still, the fix is a routine kernel update and should be rolled out in the next scheduled patch cycle rather than deferred indefinitely.
kub1 · 6.8.0-134.134 · Medium
The BPF verifier fails to correctly simulate the failure path of legacy ld_abs/ld_ind packet-load instructions inside subprograms, potentially letting a crafted BPF program pass verification when it shouldn't, risking memory corruption.
Could allow a user permitted to load custom network filtering programs to bypass kernel safety checks and potentially corrupt kernel memory.
Monitor for Ubuntu kernel update and apply when released
No fixed Ubuntu kernel package currently addresses this CVE (condition evaluates as 'default status'). Check periodically with: sudo apt update && apt-cache policy linux-image-generic. Apply the kernel update via 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot' once Canonical issues a USN for this CVE.
None applicable yet since no patch exists; future kernel upgrade will require a reboot and DKMS module rebuilds.
CVSS 6.4 and exploitation requires the ability to load BPF programs with subprograms using legacy ld_abs/ld_ind instructions, which is gated by CAP_BPF/CAP_SYS_ADMIN on Ubuntu's default unprivileged_bpf_disabled setting; not remotely exploitable, so tracking for the vendor patch is acceptable.
kub1 · 6.8.0-134.134 · Medium
Same PCMCIA smart-card reader race-condition/use-after-free as reported on the -134 kernel, requiring physical access to remove a PCMCIA card during device open.
Requires physical access to specific legacy smart-card reader hardware, an unlikely scenario for most server environments.
Blacklist the unused scr24x_cs module
1) Confirm the scr24x_cs module isn't loaded: 'lsmod | grep scr24x'. 2) Blacklist it if unused: 'echo "blacklist scr24x_cs" | sudo tee /etc/modprobe.d/blacklist-scr24x.conf'. 3) If in genuine use, update kernel: 'sudo apt update && sudo apt install --only-upgrade linux-image-6.8.0-137-generic' then 'sudo reboot'.
No impact from blacklisting on systems without this hardware; kernel update path requires reboot and DKMS module rebuilds.
Identical to the -134 finding: physical-access requirement against rarely-present legacy hardware makes this a low-priority, deferrable item.
kub1 · 6.8.0-137.137 · Medium
Same UDP SO_REUSEPORT classic-BPF use-after-free race as on the 134 kernel: replacing a reuseport filter while another thread delivers a UDP packet can free the filter before the RCU grace period completes, causing a use-after-free read.
A local process or user racing socket configuration changes could crash the server, causing a service outage.
Monitor for Ubuntu kernel update and apply when released
No fixed Ubuntu kernel package currently addresses this CVE even on the newer 6.8.0-137.137 build (condition is 'default status', applying regardless of version). Monitor with 'sudo apt update && apt-cache policy linux-image-generic' and apply the update via 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot' once Canonical ships the backport.
None applicable yet; future upgrade will require reboot and DKMS module rebuilds.
CVSS 6.4, local-trigger-only race condition with no patch currently shippable for this kernel line; not remotely exploitable, so continue tracking Canonical's advisory rather than taking interim action.
kub1 · 6.8.0-137.137 · Medium
Same BPF verifier gap on the 137 kernel build: the failure path for legacy ld_abs/ld_ind packet-load instructions inside subprograms isn't correctly simulated, potentially letting unsafe BPF programs pass verification.
Could allow a user permitted to load custom network filtering programs to bypass kernel safety checks and potentially corrupt kernel memory.
Monitor for Ubuntu kernel update and apply when released
No fixed Ubuntu kernel package is available yet for this CVE (condition is 'default status'). Monitor with 'sudo apt update && apt-cache policy linux-image-generic' and apply via 'sudo apt install --only-upgrade linux-image-generic linux-headers-generic && sudo reboot' once released.
None applicable yet; future upgrade will require reboot and DKMS module rebuilds.
CVSS 6.4, requires local privilege to load BPF programs with legacy packet-load instructions; not remotely exploitable and no patch currently exists to apply, so tracking is the appropriate interim action.
kub1 · 6.8.0-137.137 · Medium
A 32-bit integer overflow when calculating the region count for device-mapper mirror/log targets on very large devices causes undersized bitmap allocations, leading to out-of-bounds heap writes and a kernel crash.
Could crash the server or corrupt storage-related kernel memory when very large mirrored storage volumes are configured, risking data-service downtime.
Update kernel to 6.8.0-136.136 and reboot
Upgrade to the fixed kernel and reboot: sudo apt update && sudo apt install --only-upgrade linux-image-generic linux-headers-generic linux-image-6.8.0-136-generic linux-headers-6.8.0-136-generic && sudo reboot. Verify with 'uname -r' shows 6.8.0-136-generic or later. If any dm-mirror/dm-log targets are active, avoid deactivating/reactivating them during the maintenance window since they are unaffected by the upgrade itself.
Reboot required; hosts using LVM mirroring or dm-log-based device-mapper targets should verify target status post-reboot with 'dmsetup status' to confirm normal operation; DKMS modules rebuild automatically but should be checked.
CVSS 6.3, requires CAP_SYS_ADMIN to create the oversized device-mapper target so it's not remotely exploitable and needs an already-privileged local actor or unusual large-device configuration; still worth applying promptly since the fix is a routine kernel update and this can also occur as an unintentional operational bug on very large volumes, not just an attack.
kub1 · 6.8.0-134.134 · Medium
Known as BLURtooth, this flaw in Bluetooth Cross-Transport Key Derivation lets an unauthenticated nearby attacker overwrite an already-established authenticated Bluetooth pairing key with a weaker one, enabling man-in-the-middle attacks on the BR/EDR or LE transport.
An attacker with physical proximity could downgrade a secure Bluetooth pairing to a weaker one, enabling eavesdropping or spoofing of paired Bluetooth devices.
Disable unused Bluetooth stack
1) Check if Bluetooth is active: 'systemctl status bluetooth' and 'rfkill list'. Most servers have no Bluetooth radio and this service is inactive. 2) If unused, disable it entirely: 'sudo systemctl disable --now bluetooth' and blacklist the module: 'echo "blacklist btusb" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf'. 3) If Bluetooth is actively used, ensure BR/EDR Secure Connections and pairing policies restrict cross-transport key overwrite (kernel-level fix landed upstream; ensure kernel is current via 'sudo apt install --only-upgrade linux-image-6.8.0-134-generic' then reboot).
Disabling the bluetooth service removes any Bluetooth peripheral functionality (keyboards, mice, headsets) - confirm nothing depends on it before disabling.
CVSS 5.9 and requires close physical proximity plus active Bluetooth pairing use; on a typical headless server with Bluetooth disabled there is no exposed attack surface, so this can be deferred.
kub1 · 6.8.0-134.134 · Medium
A timing side-channel in the kernel's memory-deduplication feature (KSM/Kernel Samepage Merging) could let a remote attacker infer page contents by measuring access-time differences when uploading page-sized data to a networked service, if KSM is enabled and merging attacker-influenced pages.
On a system that merges memory pages from untrusted or multi-tenant workloads, an attacker could potentially infer sensitive data by timing memory access patterns.
Disable KSM unless required for VM memory overcommit, and isolate untrusted tenants if it is required
1) Check whether KSM is enabled: 'cat /sys/kernel/mm/ksm/run' (0 = disabled, 1 = enabled). Default Ubuntu server installs typically have this disabled unless a hypervisor stack (e.g., KVM with 'ksmtuned') explicitly turned it on. 2) If not needed, disable it: 'echo 0 | sudo tee /sys/kernel/mm/ksm/run' and remove/disable 'ksmtuned' if installed: 'sudo systemctl disable --now ksmtuned'. 3) If KSM is required for VM density on a virtualization host, keep the kernel updated: 'sudo apt install --only-upgrade linux-image-6.8.0-134-generic' then reboot, and isolate untrusted workloads from shared-memory pools where possible.
Disabling KSM on a virtualization host that relies on it for memory overcommit will increase actual RAM usage across guest VMs, potentially requiring more physical memory or reduced VM density.
CVSS 5.9; risk only materializes when KSM is enabled and a networked service processes attacker-influenced page-sized uploads, a scenario mainly relevant to multi-tenant virtualization hosts - address soon if KSM is active, otherwise safe to defer.
kub1 · 6.8.0-134.134 · Medium
Same KSM memory-deduplication timing side-channel as reported against the -134 kernel, relevant only if Kernel Samepage Merging is enabled and processing attacker-influenced data on a networked service.
On systems merging memory across untrusted workloads, an attacker could potentially infer sensitive data through timing analysis.
Disable KSM unless required, or isolate untrusted tenants if it must remain enabled
1) Check KSM status: 'cat /sys/kernel/mm/ksm/run'. 2) Disable if not required: 'echo 0 | sudo tee /sys/kernel/mm/ksm/run' and 'sudo systemctl disable --now ksmtuned' if present. 3) If required for VM density, keep the kernel patched: 'sudo apt install --only-upgrade linux-image-6.8.0-137-generic' then reboot, and avoid merging pages across trust boundaries.
Disabling KSM on hosts relying on it for memory overcommit increases physical RAM consumption and may reduce achievable VM density.
CVSS 5.9; same rationale as the -134 finding - only exploitable when KSM is active with attacker-influenced networked uploads, primarily a concern for multi-tenant virtualization hosts.
kub1 · 6.8.0-137.137 · Medium
Server kub1 is running Ubuntu 24.04.4, which is a currently supported release, but it has accumulated 1,755 total vulnerability records including 646 distinct critical/high severity findings. This volume indicates routine security updates have not been applied for an extended period, not that the OS itself is unsupported or unpatchable.
Because so many security fixes have been missed over time, this server carries a much higher-than-normal risk of being compromised through a known, already-public weakness.
Run a full apt security update catch-up on kub1 and reboot if the kernel or core libraries changed
1) Schedule a maintenance window given the scale of updates involved. 2) Refresh package metadata: sudo apt update. 3) Review pending updates: apt list --upgradable. 4) Apply all available security and package updates: sudo apt full-upgrade -y (or sudo unattended-upgrade for security-only if preferred as a first pass). 5) Check if a new kernel or core libraries (glibc, openssl, systemd) were updated: cat /var/run/reboot-required and /var/run/reboot-required.pkgs. 6) If required, reboot: sudo reboot, and confirm services return healthy post-reboot. 7) Re-run the vulnerability scanner against kub1 and confirm the total and critical/high finding counts have dropped substantially (expect a large reduction, not necessarily zero on first pass). 8) If counts remain high, repeat the cycle (some updates unlock further updates) and file remaining findings for a second remediation pass.
Applying a large backlog of updates in one pass increases the chance of a service restart, configuration file merge prompts (needrestart/dpkg conffile prompts), or a dependency-driven package removal/replacement that could affect running workloads on kub1. A kernel or glibc update will require a reboot, causing brief downtime for anything running on this host. Recommend testing in a staging window, taking a snapshot/backup first, and having a rollback plan for critical services before the maintenance window.
No specific actively-exploited critical CVE with confirmed network exposure is called out here, but 646 distinct critical/high findings represent a materially elevated risk surface that should not sit unaddressed for another full cycle; this warrants prioritized scheduling within the next maintenance window rather than immediate emergency action, since the underlying platform is supported and the remediation path is standard patching, not an urgent zero-day response.
kub1 · 24.04.4 · Critical
Estimated remediation effort: 25 minutes
Our engineering team can apply these patches, schedule reboots and harden your servers with minimal downtime.