1. Executive summary
CERT-FR published advisory CERTFR-2026-AVI-1376 on 23 October 2026 covering multiple vulnerabilities in the Ubuntu Linux kernel, affecting every supported release from Ubuntu 14.04 ESM through Ubuntu 26.04 LTS. The advisory lists remote arbitrary code execution, privilege escalation, remote denial of service, data confidentiality and integrity impact, and security policy bypass among the risks, and points to ten Ubuntu security notices dated 13 to 15 October 2026 for fixes. The highest-scored CVE in the set is CVE-2017-20285 at CVSS 9.1 critical (unsafe reflection and deserialization of untrusted data); CVE-2025-40778 at 8.6 high and CVE-2025-8677 at 7.5 high follow. None of the ten CVEs carried in the NVD, EPSS and CISA KEV data is listed in CISA KEV, and EPSS values are 0% for eight of the ten and 1% and 11% for the remaining two, so there is no evidence of exploitation in the wild at the time of writing. EMEA financial services firms running Ubuntu estate, including container hosts, hypervisors and third-party appliances built on Ubuntu, should treat this as a scheduled kernel remediation with the 9.1 flaw prioritised, not as an emergency.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The fixes sit in Ubuntu kernel packages, so remediation depends on the distribution vendor and on any downstream appliance or managed-service provider that ships an Ubuntu kernel | Firms must confirm that third-party ICT providers have applied the relevant USN updates or have a documented patching timeline, and record that confirmation in the register of information |
| NIS2 Art. 21(2)(d) | The affected component is a general-purpose operating system kernel embedded in the supply chain, including in third-party products | Entities in scope must be able to evidence that supply chain security measures cover operating system patching for both owned and supplier-provided Ubuntu systems |
No DORA incident reporting article is engaged: the source records no incident, no exploitation and no observed impact.
3. Technical analysis & attack chain
CERT-FR does not publish a per-CVE breakdown. The advisory names ten Ubuntu security notices (USN-8908-2, USN-8925-1, USN-8926-1, USN-8928-1, USN-8929-1, USN-8930-1, USN-8931-1, USN-8932-1, USN-8883-2, USN-8933-1) and a long CVE list, and states only that some of the flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. The mechanism for each CVE, the affected kernel subsystem, and the attack vector are not given in the source. The attack chain below is therefore limited to what the source and the NVD, EPSS and CISA KEV data support.
- An attacker reaches an affected Ubuntu host. The source does not state the access vector for any individual CVE, so the entry point cannot be confirmed from this advisory.
- The attacker triggers one of the kernel flaws. The CERT-FR risk list covers remote code execution, privilege escalation, remote denial of service, confidentiality and integrity impact, security# Advisory AT-2026-10-23-1496: Ubuntu Linux kernel flaws enable remote code execution and privilege escalation across LTS versions
1. Executive summary
CERT-FR published advisory CERTFR-2026-AVI-1376 on 23 October 2026 covering multiple vulnerabilities in the Ubuntu Linux kernel, affecting every supported release from Ubuntu 14.04 ESM through Ubuntu 26.04 LTS. The advisory lists remote arbitrary code execution, privilege escalation, remote denial of service, data confidentiality and integrity impact, and security policy bypass among the risks, and points to ten Ubuntu security notices dated 13 to 15 October 2026 for fixes. The highest-scored CVE in the set is CVE-2017-20285 at CVSS 9.1 critical (unsafe reflection and deserialization of untrusted data); CVE-2025-40778 at 8.6 high and CVE-2025-8677 at 7.5 high follow. None of the ten CVEs carried in the NVD, EPSS and CISA KEV data is listed in CISA KEV, and EPSS values are 0% for eight of the ten and 1% and 11% for the remaining two, so there is no evidence of exploitation in the wild at the time of writing. EMEA financial services firms running Ubuntu estate, including container hosts, hypervisors and third-party appliances built on Ubuntu, should treat this as a scheduled kernel remediation with the 9.1 flaw prioritised, not as an emergency.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The fixes sit in Ubuntu kernel packages, so remediation depends on the distribution vendor and on any downstream appliance or managed-service provider that ships an Ubuntu kernel | Firms must confirm that third-party ICT providers have applied the relevant USN updates or have a documented patching timeline, and record that confirmation in the register of information |
| NIS2 Art. 21(2)(d) | The affected component is a general-purpose operating system kernel embedded in the supply chain, including in third-party products | Entities in scope must be able to evidence that supply chain security measures cover operating system patching for both owned and supplier-provided Ubuntu systems |
No DORA incident reporting article is engaged: the source records no incident, no exploitation and no observed impact.
3. Technical analysis & attack chain
CERT-FR does not publish a per-CVE breakdown. The advisory names ten Ubuntu security notices (USN-8908-2, USN-8925-1, USN-8926-1, USN-8928-1, USN-8929-1, USN-8930-1, USN-8931-1, USN-8932-1, USN-8883-2, USN-8933-1) and a long CVE list, and states only that some of the flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. The mechanism for each CVE, the affected kernel subsystem, and the attack vector are not given in the source. The attack chain below is therefore limited to what the source and the NVD, EPSS and CISA KEV data support.
- An attacker reaches an affected Ubuntu host. The source does not state the access vector for any individual CVE, so the entry point cannot be confirmed from this advisory.
- The attacker triggers one of the kernel flaws. The CERT-FR risk list covers remote code execution, privilege escalation, remote denial of service, confidentiality and integrity impact, security policy bypass, XSS and CSRF, but does not map any of these to a specific CVE.
- Successful exploitation yields the impact associated with the triggered flaw: arbitrary code execution, privilege escalation, denial of service, or data confidentiality and integrity impact. Which CVE produces which outcome is not stated in the source.
The ten CVEs carried in the NVD, EPSS and CISA KEV data are:
| CVE | CVSS | Severity | CWE | CISA KEV | EPSS |
|---|---|---|---|---|---|
| CVE-2017-20285 | 9.1 | Critical | CWE-470, CWE-502 | No | 0% |
| CVE-2019-25777 | 7.3 | High | CWE-502, CWE-914 | No | 0% |
| CVE-2025-40778 | 8.6 | High | CWE-349 | No | 1% |
| CVE-2025-8677 | 7.5 | High | CWE-405 | No | 11% |
| CVE-2026-106552 | 4.2 | Medium | CWE-23 | No | 0% |
| CVE-2026-106553 | 2.2 | Low | CWE-669 | No | 0% |
| CVE-2026-106555 | 2.2 | Low | CWE-669 | No | 0% |
| CVE-2026-106582 | 3.7 | Low | CWE-514 | No | 0% |
| CVE-2026-106583 | 2.5 | Low | CWE-99 | No | 0% |
| CVE-2026-106584 | 2.5 | Low | CWE-193 | No | 0% |
CVE-2017-20285 is the only critical. Its CWE classification (unsafe reflection and deserialization of untrusted data) is unusual for a Linux kernel flaw and may reflect a CNA record that describes a userspace component or a mis-assignment; the NVD value is used here as authoritative, but the mechanism should be confirmed against the Ubuntu USN before relying on it for detection engineering. CVE-2019-25777 is also a deserialization flaw (CWE-502) with CWE-914 (improper control of dynamically-identified variables). CVE-2025-40778 (CWE-349, acceptance of extraneous untrusted data with trusted data) and CVE-2025-8677 (CWE-405, asymmetric resource consumption) are the two with non-zero EPSS, at 1% and 11% respectively. CVE-2025-8677's 11% EPSS is the highest in the set and the one most likely to see opportunistic scanning.
The remaining CVEs in the CERT-FR list (CVE-2026-106585 through CVE-2026-97689, roughly seventy further identifiers) are not carried in the NVD, EPSS and CISA KEV data supplied with this item. No severity, CWE or exploitation state is available for them, and they are not assessed here.
The CERT-FR advisory does not name an actor, a campaign, or a malware family. No MITRE ATT&CK profile is associated with this item, so no attribution is made. The related CERT-FR advisories from 2 October, 3 July, 9 October, 14 August, 11 September and 16 October 2026 describe the same pattern of recurring Ubuntu kernel updates and do not add technical detail beyond the primary item.
4. Mitigation & containment
P1 within 24h
- Identify every Ubuntu host on 14.04 ESM, 16.04 ESM, 18.04 ESM, 20.04 ESM, 22.04 LTS, 24.04 LTS and 26.04 LTS in the estate, including container hosts, hypervisors, build agents and any third-party appliance running an Ubuntu kernel. Record kernel version with
uname -rand package version withdpkg -l 'linux-image-*'. - Apply the kernel updates referenced in USN-8908-2, USN-8925-1, USN-8926-1, USN-8928-1, USN-8929-1, USN-8930-1, USN-8931-1, USN-8932-1, USN-8883-2 and USN-8933-1. The standard path is
apt update && apt install --only-upgrade 'linux-image-*' 'linux-headers-*'followed by a reboot, because kernel updates do not take effect until the host restarts. Confirm the running kernel matches the installed package after reboot. - Prioritise hosts where CVE-2017-20285 (CVSS 9.1) is reachable. Because the source does not state the attack vector, treat any host with an exposed kernel-facing service as in scope until the USN confirms otherwise.
P2 within 72h
- For hosts that cannot be rebooted inside 24h, apply the package update and schedule the reboot in the next maintenance window, and in the interim restrict network exposure of kernel-facing services (container runtime sockets, NFS, SMB, any service the USN identifies as the vector) to trusted segments.
- Confirm with third-party providers and appliance vendors that their Ubuntu-based products have the corresponding USN fixes, and obtain a written patching date. This is the DORA Art. 28 and NIS2 Art. 21(2)(d) evidence trail.
- Where livepatch or a vendor kernel livepatch service is in use, confirm the specific CVEs are covered before relying on it in place of a reboot.
P3 within 7 days
- Add kernel version drift to the vulnerability management report so hosts falling behind the current USN are flagged automatically.
- Review whether any host remains on 14.04 ESM or 16.04 ESM and whether continued ESM coverage is justified against the migration cost.
5. Indicators of compromise
No indicators of compromise available in the source material. CERT-FR publishes no hashes, network indicators, file paths or behavioural detail for this item, and none are present in the related advisories.
6. Detection
Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, file paths, registry keys, mutex names or network artefacts specific to these vulnerabilities. The only actionable detection is version-based: alert on hosts whose running kernel (uname -r) does not match the kernel package version installed by the current USN. That is a patch-compliance check, not a threat detection rule, and is covered in §4.
CVE assessment
10 referenced CVEs — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2017-20285 | 9.1 Critical | — | 0% | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Cla… |
| CVE-2025-40778 | 8.6 High | — | 1% | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged dat… |
| CVE-2025-8677 | 7.5 High | — | 11% | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. Th… |
| CVE-2019-25777 | 7.3 High | — | 0% | YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arb… |
| CVE-2026-106552 | 4.2 Medium | — | 0% | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations)… |
| CVE-2026-106582 | 3.7 Low | — | 0% | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2… |
| CVE-2026-106583 | 2.5 Low | — | 0% | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
| CVE-2026-106584 | 2.5 Low | — | 0% | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling… |
| CVE-2026-106553 | 2.2 Low | — | 0% | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication atte… |
| CVE-2026-106555 | 2.2 Low | — | 0% | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication at… |
7. Sources
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1376, 23 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1376/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1333, 16 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1333/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1286, 9 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1286/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1252, 2 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1252/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1162, 11 September 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1162/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-1027, 14 August 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1027/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans le noyau Linux d'Ubuntu", CERTFR-2026-AVI-0831, 3 July 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0831/
- Ubuntu security notices referenced by CERTFR-2026-AVI-1376: USN-8908-2, USN-8925-1, USN-8926-1, USN-8928-1, USN-8929-1, USN-8930-1, USN-8931-1, USN-8932-1, USN-8883-2, USN-8933-1, all dated 13 to 15 October 2026, at https://ubuntu.com/security/notices/
8. Adverse Trace position
Adverse Trace assesses this as a high-priority scheduled kernel remediation rather than an emergency. The highest CVSS in the set is 9.1 (CVE-2017-20285), but no CVE is in CISA KEV and EPSS is 0% for eight of the ten and 1% and 11% for the two highest, so there is no evidence of exploitation. The practical risk to EMEA financial services clients is concentrated in unpatched Ubuntu estate that is reachable from untrusted networks and in third-party appliances whose vendors have not yet shipped the USN fixes. The source does not provide per-CVE mechanism or attack vector, so the 9.1 rating should be treated as a prioritisation signal, not a confirmed remote-exploitable condition, until the Ubuntu USN is read. We will monitor the Ubuntu security notices for the ten USNs and for any change in CISA KEV or EPSS status, and will issue a follow-up if any CVE in this set is added to KEV or if a working exploit is published. Clients should confirm patch status against the ten USNs and return the third-party confirmation described in §4 within 72 hours.
Published via PulseTrace — Adverse Trace threat intelligence.