qualys

Photos: Black Hat USA 2026

Photo gallery from the Business Hall at Black Hat USA 2026. Interesting booths, demo stages, crowded aisles, and the moments in between. The second gallery is here. Featured vendors: Stellar Cyber, Tines, Filigran, Delinea, Prophet AI, Air Security, Legion Security. Featured people: Kunal Modasiya (Qualys) on going from vulnerability disclosure to autonomous remediation at machine speed. Jeremiah Grossman and Robert Hansen (Root Evidence) signing their book The End of Guessing. Allie Mellen (Forrester) signing her … More → The post Photos: Black Hat USA 2026 appeared first on Help Net Security .

helpnetsecurity.comAug 6, 2026extracted

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation. The company demonstrated the race against /etc/passwd and setuid-root binaries. The overwrite lands at the block layer. It survives a reboot and leaves the target's ownership, permissions, timestamps, and setuid bit untouched, so a modified setuid-root binary still runs as root. The fix was merged on July 16, and Linux vendors have begun shipping backported kernels. The patch traces the bug to Linux 4.11 in 2017: a Fixes: tag naming commit 3c68d44a2b49 and a stable backport request marked # v4.11. Who is exposed Exploitation requires three conditions: The system runs Linux 4.11 or later without the RefluXFS fix. The XFS filesystem was created with reflink=1 . The readable target and an attacker-writable directory are on the same XFS filesystem. Qualys said to patch exposed and multi-tenant systems first, which means any reflink-enabled XFS host where untrusted code can run locally, whether through a shell, a CI job, or a compromised service. The advisory lists the default installations that can meet those conditions: Red Hat Enterprise Linux 8, 9, and 10 and their downstream derivatives, Fedora Server 31 and later, Amazon Linux 2023, and Amazon Linux 2 images from December 2022 onward. RHEL 7 filesystems are not affected because they predate XFS reflink support. Debian, Ubuntu, SLES, and openSUSE do not generally use XFS for the root filesystem by default. They are exposed only if an administrator chose XFS with reflink enabled at install time. Check the root filesystem: xfs_info / | grep reflink= reflink=1 means condition two is met. Run the same check on any other mounted XFS volume where a protected file and an attacker-writable directory share the filesystem. The Stale Mapping An attacker clones a root-owned file into a scratch file with FICLONE, which needs only read access on the source, then races concurrent O_DIRECT writes against the clone. XFS reflinks use copy-on-write, so both files initially reference the same physical disk blocks. The kernel reads the data-fork mapping under the inode lock and hands it to xfs_reflink_fill_cow_hole(), which cycles that lock to reserve transaction space. A second writer can complete the copy-on-write operation during that gap and remap the cloned file to a new block. When the first writer reacquires the lock, it refreshes the copy-on-write fork but continues using the old data-fork mapping. The upstream patch describes the failure plainly: "the mappings are stale as soon as we reacquire the ILOCK." That stale address now points to a block owned only by the original protected file. XFS sees the block as unshared and permits the direct write, so data intended for the attacker's clone lands in the target instead. It is a check-then-use error across a lock cycle. The shared-status query itself is correct; what it queries is a block address captured before the lock was released. The Hacker News found the patch touches two helpers, xfs_reflink_fill_cow_hole() and xfs_reflink_fill_delalloc(). The second carries the same lock-cycle pattern and does not appear in the Qualys advisory. Saeed Abbasi, who heads the Qualys Threat Research Unit, told The Hacker News the model found both paths at the same time, because they are so similar. In both, the fix snapshots ip->i_df.if_seq before the lock is dropped and re-reads the data fork with xfs_bmapi_read() if the counter moved. Direct I/O skips the page cache and has no revalidation hook, so the write lands on disk. Because it bypasses the target inode entirely, the metadata never changes, and the researchers said their tests produced no kernel warning or log entry. On the test machine, the race usually won in under ten seconds. The published demo strips the root password on a default RHEL 10.2 box. Qualys said an AI model found the flaw. The company pointed Claude Mythos Preview, Anthropic's restricted-access frontier model, at the kernel and, per its technical advisory, "asked it to find a vulnerability similar to Dirty COW." The model located the race, wrote a working root exploit, and drafted the advisory. Researchers then reproduced it on a stock Fedora Server 44 install, checked the model's reasoning, and coordinated disclosure upstream. Abbasi said the team changed very little in that draft. They rewrote three sections the model had left as placeholders before the maintainers were contacted: the last-minute note, the acknowledgments and the timeline. They also swapped the epigraphs, replacing the model's quotes from a TV show with song lyrics. "Nothing else," he said. Qualys has been finding a lot of these. A day earlier, it disclosed a snap-confine flaw in Ubuntu Desktop, CVE-2026-8933, where two races let a local user get root on default installs. In May it found a nine-year-old bug in the kernel's ptrace checks. Patch, Then Reboot Red Hat has issued Important-rated kernel advisories across affected RHEL 8, 9, and 10 streams. The errata began landing on July 14, eight days before the coordinated disclosure: RHSA-2026:39179 and RHSA-2026:39180 for RHEL 8 and RHSA-2026:39494 for RHEL 10, with extended-support and SAP streams following through July 17. Coverage is stream-specific, so confirm an advisory exists for your exact release. Anyone who applied those errata on schedule was covered before RefluXFS had a name. Check your patch dates before assuming exposure. The vendor's bug tracker files the flaw under the title "kernel: XFS data corruption using reflink." The entry was auto-imported on July 10 and initially described the issue as possible data corruption from reflinking a file. As of July 23, Debian's tracker listed the fix in trixie-security as kernel 6.12.96-1 and in unstable as 7.1.4-1. Trixie's base kernel 6.12.94-1 and forky's 7.1.3-1 were still marked vulnerable, as were bookworm and bullseye, including their security branches. There is no mount option or sysctl that disables XFS reflinks after a filesystem has been created, and Qualys said no practical mitigation or temporary configuration change is available. SELinux in Enforcing mode, seccomp, kernel lockdown, and container boundaries all failed to stop it in the company's testing. Memory protections like KASLR and SMEP never applied: this is a block-layer write, not memory corruption. One apparent limit is not one. The race only fires if the target's block starts unshared, so a file an administrator already reflink-copied cannot be hit. The advisory says an unprivileged user can reset that condition by running chsh, and that setuid-root binaries are unlikely to have been reflinked in the first place. Qualys published no standalone exploit code. Red Hat's tracker logged a public proof-of-concept on July 22, pointing at the advisory posted to the oss-security list, which sets out the race and the exploitation steps in full. Abbasi rejected that classification. The exploitation section is "just an overview of the exploitation mechanism," he said, and Qualys will not release its exploit, though it gave the code to the XFS maintainers so they could reproduce the bug and test the fix. None of the vendors tracking the flaw had reported exploitation in the wild at the time of writing. The Hacker News has reached out to Red Hat for comment on its assessment of the flaw's impact and will update this story with any response. Installing the package does not replace the kernel already running in memory. Apply the vendor update, reboot the system, and verify that it is running the fixed kernel. Updated on July 24, 2026, with comment from Qualys.

thehackernews.comJul 23, 2026extracted

USN-8579-1: snapd vulnerabilities

Details James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300) Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933) Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226) James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300) Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933) Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comJul 21, 2026extracted

USN-8569-1: Linux kernel (HWE) vulnerabilities

ubuntu.comJul 20, 2026extracted

USN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilities

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431) It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300) Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Ethernet bonding driver; - Network drivers; - STMicroelectronics network drivers; - NVME drivers; - x86 platform drivers; - SCSI subsystem; - SPI subsystem; - TCM subsystem; - USB over IP driver; - File systems infrastructure; - HFS+ file system; - Network file system (NFS) server daemon; - SMB network file system; - IPv6 networking; - Netfilter; - Tracing infrastructure; - io_uring subsystem; - Timer subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - Ceph Core library; - IPv4 networking; - MAC80211 subsystem; - Multipath TCP; - Packet sockets; - RDS protocol; - RxRPC session sockets; - SMC sockets; - Sun RPC protocol; - TLS protocol; - X.25 network layer; - AMD SoC Alsa drivers; - KVM subsystem; (CVE-2022-48816, CVE-2023-53673, CVE-2024-35862, CVE-2024-50060, CVE-2025-37778, CVE-2025-37822, CVE-2025-37924, CVE-2025-38201, CVE-2025-40082, CVE-2025-68214, CVE-2025-68263, CVE-2025-71089, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2026-23176, CVE-2026-23180, CVE-2026-23182, CVE-2026-23190, CVE-2026-23193, CVE-2026-23198, CVE-2026-23202, CVE-2026-23206, CVE-2026-23216, CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23262, CVE-2026-23272, CVE-2026-23274, CVE-2026-23278, CVE-2026-23351, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31419, CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43114, CVE-2026-43117, CVE-2026-43186, CVE-2026-43304, CVE-2026-43341, CVE-2026-43383, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43494, CVE-2026-43501, CVE-2026-45988, CVE-2026-46028, CVE-2026-46043, CVE-2026-46119, CVE-2026-46135, CVE-2026-46195, CVE-2026-46243)

ubuntu.comJul 10, 2026extracted

USN-8499-1: Linux kernel (Xilinx) vulnerabilities

ubuntu.comJul 2, 2026extracted

USN-8497-1: Linux kernel (Low Latency) vulnerabilities

ubuntu.comJul 2, 2026extracted

USN-8489-1: Linux kernel (OEM) vulnerabilities

ubuntu.comJul 1, 2026extracted

USN-8426-1: Linux kernel (Azure) vulnerabilities

Packages linux-azure-5.15 - Linux kernel for Microsoft Azure cloud systems linux-azure-fips - Linux kernel for Microsoft Azure Cloud systems with FIPS Details It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431) It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia.... It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431) It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300) Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: Cryptographic API; Ethernet bonding driver; SMB network file system; Netfilter; io_uring subsystem; Packet sockets; RDS protocol; TLS protocol Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comJun 11, 2026extracted

Photos: Infosecurity Europe 2026

Infosecurity Europe 2026 is a cybersecurity event that took place from June 2 to 4 in London. Help Net Security was on-site and here’s a closer look at the conference. The featured vendors are: Microsoft, JupiterOne, Menlo Security, Cato Networks, Falkin, Vivida, Pen Test Partners, Netskope, Qualys, Syteca, runZero, Vanta, OneTrust, Panaseer, Airia. The post Photos: Infosecurity Europe 2026 appeared first on Help Net Security .

helpnetsecurity.comJun 5, 2026extracted

USN-8374-1: Linux kernel vulnerabilities

ubuntu.comJun 2, 2026extracted

USN-8373-1: Linux kernel vulnerabilities

ubuntu.comJun 2, 2026extracted

USN-8371-1: Linux kernel vulnerabilities

ubuntu.comJun 2, 2026extracted

USN-8370-1: Linux kernel vulnerabilities

ubuntu.comJun 2, 2026extracted

Nine-Year-Old Linux Kernel Flaw Leaks SSH Keys and Password Hashes

A nine-year-old logic flaw in the Linux kernel's process trace (ptrace) path has been discovered that could let unprivileged local users read sensitive files, including secure shell host (SSH) private keys and the system password hash, on default installations of Debian, Fedora and Ubuntu. According to new analysis from the Qualys Threat Research Unit (TRU), the vulnerability, tracked as CVE-2026-46333, has been present in mainline Linux since November 2016. Upstream patches and distribution updates are available, and working exploits are circulating publicly. The flaw is the fourth Linux kernel local security issue disclosed in three weeks, following Copy Fail, Dirty Frag and Fragnesia. A Race in the Credential Drop The bug sits in the kernel's __ptrace_may_access() function. Qualys identified a narrow window in which a privileged process that is dropping its credentials remains reachable through ptrace operations, even though its dumpable flag should have closed that path. By pairing this window with the pidfd_getfd() syscall, an attacker can capture file descriptors from a setuid binary mid-exit and inherit its access to the underlying files. pidfd_getfd() was added to the kernel in January 2020, which broadened the practical reach of the older flaw. The proof-of-concept (PoC) developed by Qualys targets ssh-keysign, a setuid binary that briefly holds SSH host private keys open during authentication signing. A second variant targets chage, stealing the open handle to /etc/shadow and exposing every user's password hash on the host. The Qualys TRU also developed working exploits against pkexec and accounts-daemon, withholding all four publicly during the coordinated disclosure window. Saeed Abbasi, senior manager at the Qualys TRU, said the technique "turns any local shell into a path to root or to sensitive credential material." Impact, Risk Profile and Mitigation The four exploits Qualys developed span a range of impacts. The chage and ssh-keysign exploits yield information disclosure, while pkexec and accounts-daemon let the attacker execute arbitrary commands as root. CVSS rated the bug 5.5, but Qualys argued the distinction between an unprivileged foothold and full host compromise collapses in practice, because the disclosed files alone are enough to take over the system. The risk profile is sharpest in environments where unprivileged shells are routinely available to untrusted parties, including shared hosting and multi-tenant CI runners. Administrators should apply the vendor kernel update for their distribution without delay. As an interim mitigation, Ubuntu and Qualys both recommend raising kernel.yama.ptrace_scope to 2 via sysctl, which gates ptrace attachment behind CAP_SYS_PTRACE and blocks the public exploit path at the cost of breaking unprivileged debugging workflows.

infosecurity-magazine.comMay 21, 2026extracted

USN-8267-1: Linux kernel vulnerabilities

Packages linux-azure - Linux kernel for Microsoft Azure Cloud systems linux-azure-fips - Linux kernel for Microsoft Azure Cloud systems with FIPS linux-oracle - Linux kernel for Oracle Cloud systems Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: ARM64... Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: ARM64 architecture; Cryptographic API; GPU drivers; Network drivers; UDF file system; NFC subsystem; Network traffic control; Sun RPC protocol; XFRM subsystem Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMay 11, 2026extracted

USN-8266-1: Linux kernel vulnerabilities

Packages linux - Linux kernel linux-aws - Linux kernel for Amazon Web Services (AWS) systems linux-aws-fips - Linux kernel for Amazon Web Services (AWS) systems with FIPS linux-aws-hwe - Linux kernel for Amazon Web Services (AWS-HWE) systems linux-azure-4.15 - Linux kernel for Microsoft Azure Cloud systems linux-fips - Linux kernel with FIPS linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems linux-gcp-4.15 - Linux kernel for Google Cloud Platform (GCP) systems linux-gcp-fips - Linux kernel for Google Cloud Platform (GCP) systems with FIPS linux-hwe - Linux hardware enablement (HWE) kernel linux-kvm - Linux kernel for cloud environments linux-oracle - Linux kernel for Oracle Cloud systems Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: GPU... Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: GPU drivers; Network drivers; Sun RPC protocol; XFRM subsystem Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMay 11, 2026extracted

USN-8261-1: Linux kernel (Xilinx) vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347) Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Xtensa architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - ATM drivers; - Drivers core; - Block device driver; - Network block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Hardware random number generator core; - TPM device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Device frequency scaling framework; - DMA engine subsystem; - ARM SCMI message protocol; - EFI core; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - IRQ chip drivers; - ISDN/mISDN subsystem; - Macintosh device drivers; - Mailbox framework; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - PCI subsystem; - PCCARD (PCMCIA/CardBus) bus subsystem; - Performance monitor drivers; - Pin controllers subsystem; - Chrome hardware platform drivers; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PTP clock framework; - PWM drivers; - Voltage and Current Regulator drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Trusted Execution Environment drivers; - TTY drivers; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Virtio Host (VHOST) subsystem; - Backlight driver; - Framebuffer layer; - Watchdog drivers; - Xen hypervisor drivers; - AFS file system; - BFS file system; - BTRFS file system; - Ceph distributed file system; - File systems infrastructure; - EFI Variable file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFS file system; - KERNFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Asynchronous Transfer Mode (ATM) subsystem; - BPF subsystem; - Ethernet bridge; - Mellanox drivers; - NFS page cache wrapper; - Memory management; - Memory Management; - Media input infrastructure; - Bluetooth subsystem; - IP tunnels definitions; - Network traffic control; - Rose network layer; - Network sockets; - io_uring subsystem; - Control group (cgroup); - Kernel crash support code; - Kernel futex primitives; - Locking primitives; - PID allocator; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Syscalls implementation; - Timer subsystem; - Tracing infrastructure; - 9P file system network protocol; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - CAIF protocol; - Ceph Core library; - Networking core; - Devlink API; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - SCTP protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - VMware vSockets driver; - Wireless networking; - eXpress Data Path; - XFRM subsystem; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - Intel ASoC drivers; - QCOM ASoC drivers; - STMicroelectronics SoC drivers; - USB sound devices; - KVM subsystem; (CVE-2024-57795, CVE-2025-21833, CVE-2025-22022, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22111, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-38022, CVE-2025-38105, CVE-2025-38234, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40325, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68206, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68734, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111, CVE-2026-23112, CVE-2026-23209, CVE-2026-23231, CVE-2026-23273)

ubuntu.comMay 7, 2026extracted

USN-8243-1: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Nios II architecture; - PowerPC architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Network block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - DMA engine subsystem; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - Intel Trace Hub HW tracing drivers; - IIO subsystem; - IIO ADC drivers; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IRQ chip drivers; - ISDN/mISDN subsystem; - Modular ISDN driver; - LED subsystem; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - UACCE accelerator framework; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - PCI subsystem; - Performance monitor drivers; - PHY drivers; - Pin controllers subsystem; - Chrome hardware platform drivers; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PWM drivers; - Voltage and Current Regulator drivers; - S/390 drivers; - SCSI subsystem; - SLIMbus drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - W1 Dallas's 1-wire bus driver; - Watchdog drivers; - Xen hypervisor drivers; - BFS file system; - BTRFS file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - BPF subsystem; - Ethernet bridge; - Memory management; - padata parallel execution mechanism; - IP tunnels definitions; - NFC subsystem; - Network traffic control; - Network sockets; - XFRM subsystem; - io_uring subsystem; - Control group (cgroup); - IRQ subsystem; - Locking primitives; - Padata parallel execution mechanism; - PID allocator; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - 9P file system network protocol; - Bluetooth subsystem; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Ethtool driver; - HSR network protocol; - IPv4 networking; - IPv6 networking; - L2TP protocol; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - Open vSwitch; - RF switch subsystem; - Rose network layer; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Rust bindings mechanism; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - Turtle Beach Wavefront ALSA driver; - Creative Sound Blaster X-Fi driver; - Intel ASoC drivers; - STMicroelectronics SoC drivers; - USB sound devices; (CVE-2022-49465, CVE-2022-49635, CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21780, CVE-2025-21861, CVE-2025-22022, CVE-2025-22058, CVE-2025-22111, CVE-2025-22121, CVE-2025-23143, CVE-2025-37849, CVE-2025-38022, CVE-2025-38057, CVE-2025-38125, CVE-2025-38129, CVE-2025-38232, CVE-2025-38236, CVE-2025-38248, CVE-2025-38408, CVE-2025-38556, CVE-2025-38584, CVE-2025-38591, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40083, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40149, CVE-2025-40153, CVE-2025-40154, CVE-2025-40164, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40211, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40319, CVE-2025-40321, CVE-2025-40322, CVE-2025-40324, CVE-2025-40331, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68176, CVE-2025-68177, CVE-2025-68185, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68200, CVE-2025-68204, CVE-2025-68211, CVE-2025-68217, CVE-2025-68220, CVE-2025-68227, CVE-2025-68229, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68257, CVE-2025-68258, CVE-2025-68261, CVE-2025-68264, CVE-2025-68266, CVE-2025-68282, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68308, CVE-2025-68312, CVE-2025-68321, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68340, CVE-2025-68344, CVE-2025-68346, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68364, CVE-2025-68365, CVE-2025-68366, CVE-2025-68367, CVE-2025-68372, CVE-2025-68724, CVE-2025-68725, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68734, CVE-2025-68740, CVE-2025-68746, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68764, CVE-2025-68765, CVE-2025-68767, CVE-2025-68769, CVE-2025-68771, CVE-2025-68774, CVE-2025-68776, CVE-2025-68777, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68787, CVE-2025-68788, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68808, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-71064, CVE-2025-71066, CVE-2025-71068, CVE-2025-71069, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71108, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71120, CVE-2025-71121, CVE-2025-71125, CVE-2025-71127, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71136, CVE-2025-71137, CVE-2025-71147, CVE-2025-71154, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23060, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23074, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23111, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

ubuntu.comMay 7, 2026extracted

USN-8224-1: Linux kernel (BlueField) vulnerabilities

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: ARM64 architecture; x86 architecture; Cryptographic API; GPU drivers; I2C subsystem; BTRFS file system; XFRM subsystem; Padata parallel execution mechanism; IPv4 networking; IPv6 networking; MAC80211 subsystem; Netfilter; Network traffic control; SMC sockets Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comApr 29, 2026extracted

USN-8163-2: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Nios II architecture; - PowerPC architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Network block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - DMA engine subsystem; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - ISDN/mISDN subsystem; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - Chrome hardware platform drivers; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PWM drivers; - Voltage and Current Regulator drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - Watchdog drivers; - BFS file system; - BTRFS file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - BPF subsystem; - Ethernet bridge; - Memory management; - padata parallel execution mechanism; - IP tunnels definitions; - Network traffic control; - Network sockets; - XFRM subsystem; - io_uring subsystem; - Control group (cgroup); - Locking primitives; - Padata parallel execution mechanism; - PID allocator; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - 9P file system network protocol; - Bluetooth subsystem; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Ethtool driver; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - Rose network layer; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Rust bindings mechanism; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - Turtle Beach Wavefront ALSA driver; - Intel ASoC drivers; - STMicroelectronics SoC drivers; - USB sound devices; (CVE-2022-49465, CVE-2022-49635, CVE-2023-53041, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21780, CVE-2025-21861, CVE-2025-22022, CVE-2025-22058, CVE-2025-22111, CVE-2025-22121, CVE-2025-23143, CVE-2025-37849, CVE-2025-38022, CVE-2025-38129, CVE-2025-38236, CVE-2025-38248, CVE-2025-38556, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40083, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40211, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40319, CVE-2025-40321, CVE-2025-40322, CVE-2025-40324, CVE-2025-40331, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68176, CVE-2025-68177, CVE-2025-68185, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68200, CVE-2025-68204, CVE-2025-68217, CVE-2025-68220, CVE-2025-68227, CVE-2025-68229, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68257, CVE-2025-68258, CVE-2025-68261, CVE-2025-68264, CVE-2025-68266, CVE-2025-68282, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68308, CVE-2025-68312, CVE-2025-68321, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68344, CVE-2025-68346, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68372, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68734, CVE-2025-68740, CVE-2025-68746, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68764, CVE-2025-68765, CVE-2025-68767, CVE-2025-68769, CVE-2025-68771, CVE-2025-68774, CVE-2025-68776, CVE-2025-68777, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68787, CVE-2025-68788, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68808, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-71064, CVE-2025-71066, CVE-2025-71068, CVE-2025-71069, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71108, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71120, CVE-2025-71121, CVE-2025-71125, CVE-2025-71127, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71136, CVE-2025-71137, CVE-2025-71147, CVE-2025-71154, CVE-2025-71180, CVE-2025-71182, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23047, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111, CVE-2026-23202, CVE-2026-23207)

ubuntu.comApr 13, 2026extracted

Analysis of one billion CISA KEV remediation records exposes limits of human-scale security

Author: Saeed Abbasi, Senior Manager, Threat Research Unit, Qualys With Time-to-Exploit now at negative seven days and autonomous AI agents accelerating threats, the data no longer supports incremental improvement. The architecture of defense must change. What Leaders Need to Know Analysis of CISA's Known Exploited Vulnerabilities over the past four years shows critical vulnerabilities still open at Day 7 worsened from 56% to 63% despite teams closing 6.5x more tickets. Staffing cannot solve this. Of the 52 tracked weaponized vulnerabilities in our study, 88% were patched more slowly than they were exploited — half were weaponized before any patch existed. The problem is not speed. It is the operational model itself. Cumulative exposure, not CVE counts, is the true risk metric that security teams now need to measure. While dashboards reward the sprint to get patches implemented, breaches exploit the tail. AI is not another attack surface — instead, the transition period where AI-powered attackers face human defenders is the industry's most dangerous window. In response, defenders have to implement their own autonomous, closed-loop risk operations. The Broken Physics New research from the Qualys Threat Research Unit, analyzing more than one billion CISA KEV remediation records from across 10,000 organizations over four years, quantifies what the industry has long suspected but never proved at scale. The operational model underpinning enterprise security is broken. Vulnerability volumes have grown 6.5 times since 2022. According to Google M-Trends 2026, the average Time-to-Exploit has collapsed to negative seven days; in other words, adversaries are weaponizing the most serious vulnerabilities before patches exist. The percentage of critical vulnerabilities still open at seven days has climbed from 56 percent to 63 percent. Yet this is not for lack of effort. Organizations closed 400 million more vulnerability events annually now than they did at baseline. Teams work harder, but it fails to make the difference where it counts. Our researchers call this the "human ceiling" — a structural limit no amount of staffing or process maturity can overcome. The constraint is not effort. It is the model itself. Of 52 high-profile weaponized vulnerabilities tracked with complete exploitation timelines, 88 percent were remediated slower than they were exploited. As an example, Spring4Shell was exploited two days before disclosure, yet the average enterprise needed 266 days to remediate. Similarly, the flaw in Cisco IOS XE was weaponized a month early; average close was 263 days. The attacker's advantage was measured in days. The defender's response was measured in seasons. This is not an intelligence failure. It is an operationalization failure. To understand the future around risk operations, AI and managing remediation at scale, come to ROCON EMEA, the Risk Operations Center Conference. Join your peers and learn more about automated remediation. Register Today The Manual Tax and Risk Mass The report identifies a "Manual Tax" — the multiplier effect where long-tail assets that human processes cannot reach drag exposure from weeks into months. For Spring4Shell, average remediation was 5.4 times the median. The median tells a manageable story. The average tells the truth. Infrastructure systems face a harsher reality: for Cisco IOS XE, even the median was 232 days — compared to endpoint medians consistently under 14. When the best-case outcome is eight months, the Manual Tax is no longer a multiplier. It is the baseline. Looking at average figures is no longer helpful for decision-making. Instead, looking at Risk Mass — vulnerable assets multiplied by days exposed — captures what CVE counts obscure around cumulative exposure. A companion metric, Average Window of Exposure (AWE), measures the full duration from weaponization to remediation across the environment. As an example, Follina was weaponized 30 days before disclosure with an average close at Day 55. However, the AWE stretched to 85 days. While the blind spot before disclosure accounted for 36 percent of that 85 days, the long tail of patching accounted for a further 44 percent. In total, pre-disclosure and long tail together represent 80 percent. The sprint that gets measured makes up less than 20. At the same time, of 48,172 vulnerabilities disclosed in 2025, only 357 were remotely exploitable and actively weaponized. Organizations are burning remediation cycles on theoretical exposure while genuinely exploitable gaps persist. Why the Gap Will Widen Cybersecurity has long operated as a derivative of technology shifts — Windows security followed Windows, cloud security followed cloud. Leading practitioners and investors now argue AI breaks that pattern. It is not merely a new surface to defend; it is a fundamental transformation of the adversary itself. Offensive agents can already discover, weaponize, and execute faster than any human-staffed operation can respond. The remediation data proves humans cannot keep pace today. Autonomous AI ensures the gap will accelerate tomorrow. The transition period — where AI-powered attackers face human-speed defenders — represents the industry's most dangerous window, compounded by the structural vulnerabilities that dominate the near term: attack surfaces expanded beyond what teams can govern, identity sprawl that outpaces policy, and remediation workflows still built on manual execution. The traditional scan-and-report model was built for lower volumes of CVEs and longer exploit timelines. What replaces it is an end-to-end Risk Operations Center: embedded intelligence arriving as machine-readable decision logic, active confirmation validating whether a vulnerability is actually exploitable in a specific environment, and autonomous action compressing response to the timescale the threat demands. The objective is not to eliminate human judgment but to elevate it, shifting practitioners from tactical execution to governing the policies that direct their own autonomous systems. The organizations already winning the physics gap are not winning with larger teams. They are winning because they have removed human latency from the critical path. How Security Teams can close the Risk Gap The scan-and-report model — discover, score, ticket, manually route — was built for lower volumes and longer exploit timelines. What replaces it is an end-to-end Risk Operations Center: embedded intelligence arriving as machine-readable decision logic, active confirmation validating whether a vulnerability is actually exploitable in a specific environment, and autonomous action compressing response to the timescale the threat demands. The objective is not to eliminate human judgment but to elevate it — shifting practitioners from tactical execution to governing the policies that direct autonomous systems. The organizations already winning the physics gap are not winning with larger teams. They are winning because they have removed human latency from the critical path. Time-to-Exploit will not return to positive numbers. Vulnerability volume will not plateau. The reactive model has hit a hard mathematical ceiling. The only remaining question is whether organizations will use the architecture to match the mathematics — before the window between human-scale defense and autonomous-scale offense closes for good. Contact Qualys for insights into how companies manage remediation at scale with automation and AI, and how you can make that difference right now. Sponsored and written by Qualys.

bleepingcomputer.comApr 10, 2026extracted

USN-8165-1: Linux kernel (Azure FIPS) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; - S390 architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Xtensa architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - ATM drivers; - Drivers core; - Block device driver; - Network block device driver; - Bluetooth drivers; - Bus devices; - Hardware random number generator core; - Character device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Device frequency scaling framework; - DMA engine subsystem; - ARM SCMI message protocol; - EFI core; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - ISDN/mISDN subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - NVME drivers; - PCI subsystem; - PCCARD (PCMCIA/CardBus) bus subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PTP clock framework; - PWM drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - TCM subsystem; - Trusted Execution Environment drivers; - TTY drivers; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Xen hypervisor drivers; - AFS file system; - BTRFS file system; - Ceph distributed file system; - File systems infrastructure; - EFI Variable file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - HugeTLB file system; - JFS file system; - KERNFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Asynchronous Transfer Mode (ATM) subsystem; - BPF subsystem; - Mellanox drivers; - NFS page cache wrapper; - Memory management; - Memory Management; - Media input infrastructure; - Bluetooth subsystem; - IP tunnels definitions; - Network traffic control; - Rose network layer; - Network sockets; - io_uring subsystem; - Control group (cgroup); - Kernel crash support code; - Kernel futex primitives; - PID allocator; - Scheduler infrastructure; - Syscalls implementation; - Timer subsystem; - Tracing infrastructure; - 9P file system network protocol; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - SCTP protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - VMware vSockets driver; - Wireless networking; - eXpress Data Path; - XFRM subsystem; - Integrity Measurement Architecture(IMA) framework; - Intel ASoC drivers; - QCOM ASoC drivers; - USB sound devices; (CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111)

ubuntu.comApr 9, 2026extracted

USN-8164-1: Linux kernel (Intel IoTG Real-time) vulnerabilities

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: ARM64 architecture; Cryptographic API; Netfilter; Network traffic control Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comApr 9, 2026extracted

USN-8163-1: Linux kernel (Azure FIPS) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Nios II architecture; - PowerPC architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Network block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - DMA engine subsystem; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - ISDN/mISDN subsystem; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - Chrome hardware platform drivers; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PWM drivers; - Voltage and Current Regulator drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - Watchdog drivers; - BFS file system; - BTRFS file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - BPF subsystem; - Ethernet bridge; - Memory management; - padata parallel execution mechanism; - IP tunnels definitions; - Network traffic control; - Network sockets; - XFRM subsystem; - io_uring subsystem; - Control group (cgroup); - Locking primitives; - Padata parallel execution mechanism; - PID allocator; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - 9P file system network protocol; - Bluetooth subsystem; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Ethtool driver; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - Rose network layer; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Rust bindings mechanism; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - Turtle Beach Wavefront ALSA driver; - Intel ASoC drivers; - STMicroelectronics SoC drivers; - USB sound devices; (CVE-2022-49465, CVE-2022-49635, CVE-2023-53041, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21780, CVE-2025-21861, CVE-2025-22022, CVE-2025-22058, CVE-2025-22111, CVE-2025-22121, CVE-2025-23143, CVE-2025-37849, CVE-2025-38022, CVE-2025-38129, CVE-2025-38236, CVE-2025-38248, CVE-2025-38556, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40083, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40211, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40319, CVE-2025-40321, CVE-2025-40322, CVE-2025-40324, CVE-2025-40331, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68176, CVE-2025-68177, CVE-2025-68185, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68200, CVE-2025-68204, CVE-2025-68217, CVE-2025-68220, CVE-2025-68227, CVE-2025-68229, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68257, CVE-2025-68258, CVE-2025-68261, CVE-2025-68264, CVE-2025-68266, CVE-2025-68282, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68308, CVE-2025-68312, CVE-2025-68321, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68344, CVE-2025-68346, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68372, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68734, CVE-2025-68740, CVE-2025-68746, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68764, CVE-2025-68765, CVE-2025-68767, CVE-2025-68769, CVE-2025-68771, CVE-2025-68774, CVE-2025-68776, CVE-2025-68777, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68787, CVE-2025-68788, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68808, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-71064, CVE-2025-71066, CVE-2025-71068, CVE-2025-71069, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71108, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71120, CVE-2025-71121, CVE-2025-71125, CVE-2025-71127, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71136, CVE-2025-71137, CVE-2025-71147, CVE-2025-71154, CVE-2025-71180, CVE-2025-71182, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23047, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111, CVE-2026-23202, CVE-2026-23207)

ubuntu.comApr 9, 2026extracted

USN-8152-1: Linux kernel (OEM) vulnerabilities

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ATM drivers; - Network block device driver; - Bluetooth drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - Device frequency scaling framework; - Intel Stratix 10 firmware drivers; - GPIO subsystem; - GPU drivers; - Microsoft Hyper-V drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - Pin controllers subsystem; - x86 platform drivers; - Voltage and Current Regulator drivers; - Real Time Clock drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - UFS subsystem; - DesignWare USB3 driver; - USB Gadget drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - AFS file system; - BFS file system; - BTRFS file system; - EROFS file system; - Ext4 file system; - FAT file system; - GFS2 file system; - Journaling layer for block devices (JBD2); - File systems infrastructure; - Network file system (NFS) client; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - XFS file system; - BPF subsystem; - MediaTek SoC drivers; - Bluetooth subsystem; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Timer subsystem; - Tracing infrastructure; - Kexec HandOver (KHO); - Memory management; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - Multipath TCP; - Netfilter; - Open vSwitch; - Network traffic control; - VMware vSockets driver; - eXpress Data Path; - Integrity Measurement Architecture(IMA) framework; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222, CVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228, CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232, CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236, CVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295, CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299, CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307, CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325, CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333, CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341, CVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349, CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358, CVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372, CVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729, CVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735, CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746, CVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751, CVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-71128, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111)

ubuntu.comApr 6, 2026extracted

USN-8095-5: Linux kernel (Raspberry Pi) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; - S390 architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Xtensa architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - ATM drivers; - Drivers core; - Block device driver; - Network block device driver; - Bluetooth drivers; - Bus devices; - Hardware random number generator core; - Character device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Device frequency scaling framework; - DMA engine subsystem; - ARM SCMI message protocol; - EFI core; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - ISDN/mISDN subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - NVME drivers; - PCI subsystem; - PCCARD (PCMCIA/CardBus) bus subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PTP clock framework; - PWM drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - TCM subsystem; - Trusted Execution Environment drivers; - TTY drivers; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Xen hypervisor drivers; - AFS file system; - BTRFS file system; - Ceph distributed file system; - File systems infrastructure; - EFI Variable file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - HugeTLB file system; - JFS file system; - KERNFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Asynchronous Transfer Mode (ATM) subsystem; - BPF subsystem; - Mellanox drivers; - NFS page cache wrapper; - Memory management; - Memory Management; - Media input infrastructure; - Bluetooth subsystem; - IP tunnels definitions; - Network traffic control; - Rose network layer; - Network sockets; - io_uring subsystem; - Control group (cgroup); - Kernel crash support code; - Kernel futex primitives; - PID allocator; - Scheduler infrastructure; - Syscalls implementation; - Timer subsystem; - Tracing infrastructure; - 9P file system network protocol; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - SCTP protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - VMware vSockets driver; - Wireless networking; - eXpress Data Path; - XFRM subsystem; - Integrity Measurement Architecture(IMA) framework; - Intel ASoC drivers; - QCOM ASoC drivers; - USB sound devices; (CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734)

ubuntu.comApr 1, 2026extracted

USN-8141-1: Linux kernel (Raspberry Pi) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - PowerPC architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - Drivers core; - Network block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Hardware random number generator core; - TPM device driver; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - DMA engine subsystem; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - ISDN/mISDN subsystem; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - Chrome hardware platform drivers; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PWM drivers; - Voltage and Current Regulator drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - Watchdog drivers; - BFS file system; - BTRFS file system; - File systems infrastructure; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - BPF subsystem; - Ethernet bridge; - Memory management; - padata parallel execution mechanism; - IP tunnels definitions; - Network traffic control; - Network sockets; - XFRM subsystem; - io_uring subsystem; - Control group (cgroup); - Locking primitives; - Padata parallel execution mechanism; - PID allocator; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - 9P file system network protocol; - Bluetooth subsystem; - CAIF protocol; - CAN network layer; - Ceph Core library; - Networking core; - Ethtool driver; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - Rose network layer; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Rust bindings mechanism; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - Turtle Beach Wavefront ALSA driver; - Intel ASoC drivers; - STMicroelectronics SoC drivers; - USB sound devices; (CVE-2022-49465, CVE-2022-49635, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21780, CVE-2025-21861, CVE-2025-22022, CVE-2025-22058, CVE-2025-22111, CVE-2025-22121, CVE-2025-23143, CVE-2025-38022, CVE-2025-38129, CVE-2025-38236, CVE-2025-38248, CVE-2025-38556, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40083, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40211, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40319, CVE-2025-40321, CVE-2025-40322, CVE-2025-40324, CVE-2025-40331, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68176, CVE-2025-68177, CVE-2025-68185, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68200, CVE-2025-68204, CVE-2025-68217, CVE-2025-68220, CVE-2025-68227, CVE-2025-68229, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68257, CVE-2025-68258, CVE-2025-68261, CVE-2025-68264, CVE-2025-68266, CVE-2025-68282, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68308, CVE-2025-68312, CVE-2025-68321, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68344, CVE-2025-68346, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68372, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68734, CVE-2025-68740, CVE-2025-68746, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68764, CVE-2025-68765, CVE-2025-68767, CVE-2025-68769, CVE-2025-68771, CVE-2025-68774, CVE-2025-68776, CVE-2025-68777, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68787, CVE-2025-68788, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68808, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-71064, CVE-2025-71066, CVE-2025-71068, CVE-2025-71069, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71108, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71120, CVE-2025-71121, CVE-2025-71125, CVE-2025-71127, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71136, CVE-2025-71137, CVE-2025-71147, CVE-2025-71154, CVE-2025-71180, CVE-2025-71182, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23047)

ubuntu.comApr 1, 2026extracted

USN-8094-5: Linux kernel (Raspberry Pi) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ATM drivers; - Network block device driver; - Bluetooth drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - Device frequency scaling framework; - Intel Stratix 10 firmware drivers; - GPIO subsystem; - GPU drivers; - Microsoft Hyper-V drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - Pin controllers subsystem; - x86 platform drivers; - Voltage and Current Regulator drivers; - Real Time Clock drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - UFS subsystem; - DesignWare USB3 driver; - USB Gadget drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - AFS file system; - BFS file system; - BTRFS file system; - EROFS file system; - Ext4 file system; - FAT file system; - GFS2 file system; - Journaling layer for block devices (JBD2); - File systems infrastructure; - Network file system (NFS) client; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - XFS file system; - BPF subsystem; - MediaTek SoC drivers; - Bluetooth subsystem; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Timer subsystem; - Tracing infrastructure; - Kexec HandOver (KHO); - Memory management; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - Multipath TCP; - Open vSwitch; - Network traffic control; - VMware vSockets driver; - eXpress Data Path; - Integrity Measurement Architecture(IMA) framework; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222, CVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228, CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232, CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236, CVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295, CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299, CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307, CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325, CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333, CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341, CVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349, CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358, CVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372, CVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729, CVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735, CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746, CVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751, CVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-71128)

ubuntu.comApr 1, 2026extracted

RSAC 2026 Conference Announcements Summary (Days 3-4)

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential news from the third and fourth days of the event (as well as some announcements we may have missed in the previous days). Roundups of announcements from day 1, day 2, and the days leading up to the conference are also available. Accenture has introduced Cyber.AI, a new cybersecurity solution that uses Anthropic’s Claude model as a central reasoning engine to automate security workflows. The platform integrates a library of autonomous agents to synthesize security data and provide contextual insights throughout the security lifecycle. It features a specialized component called Agent Shield to monitor and govern these autonomous agents in real-time to ensure they adhere to defined organizational policies. Akamai and Bolster AI detect brand impersonation and phishing Bolster AI and Akamai have teamed up to help organizations detect and disrupt brand impersonation and phishing campaigns targeting their customers. The new Brand Guardian solution combines Akamai’s global internet infrastructure with Bolster’s AI-driven fraud detection and automated takedown technology to detect impersonation campaigns earlier, observe attacks from the victim’s perspective, disrupt campaigns using automated investigation and takedown workflows, and understand campaign impact. Arctic Wolf Labs has analyzed over 22,000 AI‑assisted malware samples and found that a significant share of this malware is novel and harder to catch with traditional tools—39% initially evaded signature-based detection. While AI increases the scale of threats, most activity is not tied to sophisticated or known actors, and the resulting malware can still be detected with the right layered defenses. Barracuda Networks has announced enhancements to its BarracudaONE cybersecurity platform, along with a revamped global Partner Success Program, aimed at strengthening cyber resilience and supporting partner growth. The platform updates boost protection across email, network access, and generative AI usage. Barracuda has overhauled its Partner Success Program, creating a unified model for MSPs, resellers, and hybrid partners with expanded benefits and incentives. CrowdStrike announced the Charlotte AI AgentWorks ecosystem for building secure agents, with launch partners including Accenture, AWS, Anthropic, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, and Telefónica Tech. The ecosystem enables customers to leverage CrowdStrike’s no-code development platform and frontier AI models to securely build, orchestrate, and scale custom security agents, while opening new opportunities for partners to create agentic security businesses on the Falcon platform. CyberProof MDR analysts and threat researchers have identified a significant surge in PXA Stealer activity targeting global financial institutions during Q1 2026. These campaigns primarily leverage phishing emails containing malicious URLs that trigger the download of compromised ZIP attachments. Threat actors have demonstrated high levels of adaptability, utilizing diverse lures ranging from curriculum vitae and Adobe Photoshop installers to tax forms and legal documentation. Following the 2025 takedowns of major infostealers such as Lumma, Rhadamanthys, and RedLine, CyberProof observed that PXA Stealer activity has filled the resulting vacuum, seeing an estimated growth of 8-10%. Cyber Sierra announced a new collaboration with ST Engineering’s Cyber business to help organisations bring together AI‑driven governance and frontline cybersecurity operations for continuous, outcome-focused cyber resilience. DigiCert has introduced several updates to its Document Trust Manager platform to streamline digital signing workflows and enhance key security. The system now features centralized key management (eliminating the need for physical tokens by providing secure cloud-based storage for signing certificates). New unified workflows provide enterprise-wide visibility into signing activities (allowing administrators to monitor document integrity and track usage across the organization). The platform also supports various global PKI standards to ensure compliance with regional regulatory requirements for cross-border digital transactions. Ironscales announced ‘Email Attack of the Day,’ an ongoing email threat intelligence blog series spotlighting recent, real phishing attacks caught by the organization’s adaptive AI and its community of 30,000+ security professionals. Each post breaks down one attack — what it looked like, why it worked, and what users can do about it. The company also introduced new email security agents that anticipate, investigate, and prepare for advanced phishing attacks. Menlo Security has released a platform designed to monitor and control the activities of autonomous AI agents operating within web browsers. The platform provides visibility into agent-driven web sessions to prevent unauthorized data exfiltration and ensure compliance with corporate governance standards. The solution allows organizations to define granular permissions for AI agents. Minimus announced a new open source program that provides maintainers with free access to hardened container images, SBOM generation and analysis, and real-time threat intelligence. The initiative aims to close the security gap for open source projects that underpin critical infrastructure but lack enterprise-grade supply-chain security tooling. Accepted projects can integrate Minimus images into their pipelines to reduce attack surface, gain visibility into dependencies, and accelerate vulnerability remediation. Nile has updated its networking platform to incorporate “datacenter-class” security features designed to limit lateral movement within campus and branch environments. The architecture utilizes AI-driven automation to enforce granular micro-segmentation. By integrating these controls directly into the network fabric, the system aims to contain potential breaches by reducing the available attack surface. Singapore-based pQCee has introduced a crypto-agile Cryptography Next Generation (CNG) provider for Microsoft Windows. It allows enterprises, governments, and regulated industries to rapidly adopt post-quantum cryptographic algorithms, comply with national security requirements, and prepare for integration with emerging quantum hardware. The solution provides seamless support for custom post-quantum algorithms and implementations directly within Windows. Protos Labs has introduced a free tier of Protos AI, its agentic AI platform designed to automate the collection and analysis of cyber threat intelligence (CTI). The system utilizes specialized AI agents to execute tasks across the CTI lifecycle (including planning, evidence collection, and citation-backed reporting). The platform is model-agnostic and functions independently of existing security stacks to build ‘organizational intelligence memory’ by linking threat entities across historical investigations. Human analysts maintain control by approving investigation plans and validating the agents’ outputs before dissemination. Quokka Q-scout now integrates with Microsoft Sentinel to centralize mobile application risk intelligence across Microsoft Intune-managed devices. The connector automatically ingests app inventories from Intune, analyzes them using Quokka’s mobile app vetting engines, and streams security, privacy, and compliance risk findings into Sentinel. The Qualys Threat Research Unit (TRU) released what it described as the largest remediation study ever conducted, examining more than 1 billion CISA KEV records across over 10,000 organizations spanning four years. The study found that vulnerability volume has increased 6.5x in the last three years, while exploitation timelines have collapsed to -1 days. Despite processing more tickets, security teams left 63% of critical vulnerabilities open on day 7 in 2025, a deterioration from 56% in 2022. Out of 52 actively weaponized vulnerabilities that were analyzed, half were exploited before public disclosure. Singapore-based Scantist has announced the US launch of PAIStrike, an autonomous penetration testing platform designed to validate real-world security risks. PAIStrike functions as a coordinated multi-agent system that autonomously analyzes targets, devises multi-step attack strategies, executes exploits, evaluates results, and dynamically adjusts its tactics in real time. Skyhigh Security announced new capabilities for its Security Service Edge (SSE) platform. The company introduced new offerings and updates to strengthen its platform, including Next-Generation SSE Hybrid and Secure Browser Controls solutions, along with updates to Skyhigh DSPM to create a unified view of data risk across multi-vendor environments. Vorlon has launched two new products, AI Agent Flight Recorder and AI Agent Action Center, to provide forensics and coordinated response for enterprise AI and SaaS environments. The Flight Recorder uses intelligent simulation technology to capture a continuous audit trail of agent actions across various identities, APIs, and data classifications. To address identified risks, the Action Center prioritizes security findings and routes remediation guidance to relevant stakeholders. These tools integrate with existing security workflows, including SIEM and SOAR platforms.

securityweek.comMar 27, 2026extracted

USN-8098-9: Linux kernel (IBM) vulnerabilities

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMar 27, 2026extracted

USN-8126-1: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331) Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Xtensa architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - ATA over ethernet (AOE) driver; - DRBD Distributed Replicated Block Device drivers; - Block device driver; - Network block device driver; - Ublk userspace block driver; - Bluetooth drivers; - Bus devices; - Hardware random number generator core; - Character device driver; - TPM device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Device frequency scaling framework; - Buffer Sharing and Synchronization framework; - DMA engine subsystem; - EDAC drivers; - Arm Firmware Framework for ARMv8-A(FFA); - ARM SCMI message protocol; - EFI core; - Intel Stratix 10 firmware drivers; - FPGA Framework; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - CoreSight HW tracing drivers; - I2C subsystem; - I3C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - IRQ chip drivers; - ISDN/mISDN subsystem; - Mailbox framework; - MCB driver; - Multiple devices driver; - Media drivers; - Multifunction device drivers; - Fastrpc Driver; - Microchip PCI driver; - Intel Management Engine Interface driver; - PCI Endpoint Test driver; - TI TPS6594 PFSM driver; - VMware VMCI Driver; - MMC subsystem; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVDIMM (Non-Volatile Memory Device) drivers; - NVME drivers; - PCI subsystem; - PCCARD (PCMCIA/CardBus) bus subsystem; - Amlogic Meson DDR PMU; - Performance monitor drivers; - PHY drivers; - Pin controllers subsystem; - x86 platform drivers; - ARM PM domains; - Power supply drivers; - Powercap sysfs driver; - PPS (Pulse Per Second) driver; - PTP clock framework; - PWM drivers; - RapidIO drivers; - Voltage and Current Regulator drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - ASPEED SoC drivers; - QCOM SoC drivers; - Samsung SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - small TFT LCD display modules; - Media staging drivers; - TCM subsystem; - Trusted Execution Environment drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - UFS subsystem; - Userspace I/O drivers; - Cadence USB3 driver; - ChipIdea USB driver; - USB Device Class drivers; - USB core drivers; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C support driver; - USB Type-C Connector System Software Interface driver; - VFIO drivers; - Virtio Host (VHOST) subsystem; - Backlight driver; - Framebuffer layer; - TSM Common Guest driver; - Virtio drivers; - Xen hypervisor drivers; - AFS file system; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EFI Variable file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - HugeTLB file system; - Journaling layer for block devices (JBD2); - JFFS2 file system; - JFS file system; - KERNFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Overlay file system; - Proc file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - DRM display driver; - Asynchronous Transfer Mode (ATM) subsystem; - BPF subsystem; - Memory Management; - Internal shared memory driver; - LZO compression library; - Mellanox drivers; - NFS page cache wrapper; - padata parallel execution mechanism; - Memory management; - Networking subsytem; - Media input infrastructure; - Bluetooth subsystem; - IP tunnels definitions; - Netfilter; - Network traffic control; - Rose network layer; - SCTP protocol; - Network sockets; - UDP network protocol; - eXpress Data Path; - XFRM subsystem; - Digital Audio (PCM) driver; - Universal MIDI packet (UMP) support module; - Tracing infrastructure; - User-space API (UAPI); - io_uring subsystem; - IPC subsystem; - Control group (cgroup); - Kernel crash support code; - Perf events; - Kernel exit() syscall; - Kernel futex primitives; - IRQ subsystem; - Padata parallel execution mechanism; - Kernel command line parsing driver; - PID allocator; - Hibernation control; - RCU subsystem; - Restartable seuqences system call mechanism; - Scheduler infrastructure; - Syscalls implementation; - Timer subsystem; - Maple Tree data structure library; - KASAN memory debugging framework; - 802.1Q VLAN protocol; - 9P file system network protocol; - Appletalk network protocol; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - CAN network layer; - Ceph Core library; - Networking core; - Devlink API; - Distributed Switch Architecture; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Management Component Transport Protocol (MCTP); - MultiProtocol Label Switching driver; - Multipath TCP; - NetLabel subsystem; - Netlink; - NFC subsystem; - Open vSwitch; - RDS protocol; - RF switch subsystem; - RxRPC session sockets; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Integrity Measurement Architecture(IMA) framework; - ALSA framework; - WCD audio codecs; - Intel ASoC drivers; - MediaTek ASoC drivers; - QCOM ASoC drivers; - SoC audio core drivers; - USB sound devices; - Virtio sound driver; - CPU Power monitoring subsystem; - KVM subsystem; (CVE-2025-21833, CVE-2025-21884, CVE-2025-21931, CVE-2025-22026, CVE-2025-22037, CVE-2025-22101, CVE-2025-22102, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22115, CVE-2025-22120, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-22126, CVE-2025-22128, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23140, CVE-2025-23141, CVE-2025-23142, CVE-2025-23143, CVE-2025-23144, CVE-2025-23145, CVE-2025-23146, CVE-2025-23147, CVE-2025-23148, CVE-2025-23149, CVE-2025-23150, CVE-2025-23151, CVE-2025-23155, CVE-2025-23156, CVE-2025-23157, CVE-2025-23158, CVE-2025-23159, CVE-2025-23160, CVE-2025-23161, CVE-2025-23163, CVE-2025-37738, CVE-2025-37739, CVE-2025-37740, CVE-2025-37741, CVE-2025-37742, CVE-2025-37744, CVE-2025-37745, CVE-2025-37748, CVE-2025-37749, CVE-2025-37754, CVE-2025-37755, CVE-2025-37757, CVE-2025-37758, CVE-2025-37759, CVE-2025-37761, CVE-2025-37763, CVE-2025-37764, CVE-2025-37765, CVE-2025-37766, CVE-2025-37767, CVE-2025-37768, CVE-2025-37769, CVE-2025-37770, CVE-2025-37771, CVE-2025-37772, CVE-2025-37773, CVE-2025-37775, CVE-2025-37777, CVE-2025-37778, CVE-2025-37780, CVE-2025-37781, CVE-2025-37784, CVE-2025-37786, CVE-2025-37787, CVE-2025-37788, CVE-2025-37789, CVE-2025-37790, CVE-2025-37792, CVE-2025-37793, CVE-2025-37794, CVE-2025-37796, CVE-2025-37799, CVE-2025-37800, CVE-2025-37801, CVE-2025-37803, CVE-2025-37805, CVE-2025-37808, CVE-2025-37809, CVE-2025-37810, CVE-2025-37811, CVE-2025-37812, CVE-2025-37813, CVE-2025-37815, CVE-2025-37816, CVE-2025-37817, CVE-2025-37819, CVE-2025-37820, CVE-2025-37822, CVE-2025-37823, CVE-2025-37824, CVE-2025-37826, CVE-2025-37827, CVE-2025-37828, CVE-2025-37829, CVE-2025-37830, CVE-2025-37831, CVE-2025-37836, CVE-2025-37839, CVE-2025-37840, CVE-2025-37841, CVE-2025-37842, CVE-2025-37844, CVE-2025-37846, CVE-2025-37849, CVE-2025-37850, CVE-2025-37851, CVE-2025-37852, CVE-2025-37853, CVE-2025-37854, CVE-2025-37856, CVE-2025-37857, CVE-2025-37858, CVE-2025-37859, CVE-2025-37860, CVE-2025-37861, CVE-2025-37862, CVE-2025-37863, CVE-2025-37864, CVE-2025-37865, CVE-2025-37867, CVE-2025-37869, CVE-2025-37871, CVE-2025-37872, CVE-2025-37873, CVE-2025-37874, CVE-2025-37875, CVE-2025-37878, CVE-2025-37879, CVE-2025-37881, CVE-2025-37883, CVE-2025-37884, CVE-2025-37885, CVE-2025-37886, CVE-2025-37887, CVE-2025-37891, CVE-2025-37892, CVE-2025-37897, CVE-2025-37899, CVE-2025-37900, CVE-2025-37901, CVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911, CVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915, CVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920, CVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924, CVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930, CVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936, CVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944, CVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949, CVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957, CVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962, CVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969, CVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975, CVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980, CVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985, CVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989, CVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994, CVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004, CVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008, CVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013, CVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019, CVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027, CVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037, CVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044, CVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052, CVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058, CVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062, CVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067, CVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074, CVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079, CVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089, CVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097, CVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101, CVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38105, CVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110, CVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115, CVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122, CVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126, CVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135, CVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143, CVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148, CVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155, CVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159, CVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163, CVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167, CVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174, CVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183, CVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191, CVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197, CVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208, CVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214, CVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219, CVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226, CVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232, CVE-2025-38236, CVE-2025-38239, CVE-2025-38245, CVE-2025-38246, CVE-2025-38248, CVE-2025-38249, CVE-2025-38250, CVE-2025-38251, CVE-2025-38253, CVE-2025-38255, CVE-2025-38257, CVE-2025-38258, CVE-2025-38259, CVE-2025-38260, CVE-2025-38262, CVE-2025-38263, CVE-2025-38264, CVE-2025-38265, CVE-2025-38269, CVE-2025-38274, CVE-2025-38275, CVE-2025-38277, CVE-2025-38278, CVE-2025-38279, CVE-2025-38280, CVE-2025-38282, CVE-2025-38283, CVE-2025-38285, CVE-2025-38286, CVE-2025-38289, CVE-2025-38290, CVE-2025-38292, CVE-2025-38293, CVE-2025-38295, CVE-2025-38298, CVE-2025-38299, CVE-2025-38300, CVE-2025-38303, CVE-2025-38304, CVE-2025-38305, CVE-2025-38307, CVE-2025-38310, CVE-2025-38312, CVE-2025-38313, CVE-2025-38319, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322, CVE-2025-38323, CVE-2025-38324, CVE-2025-38326, CVE-2025-38328, CVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334, CVE-2025-38335, CVE-2025-38336, CVE-2025-38337, CVE-2025-38338, CVE-2025-38342, CVE-2025-38343, CVE-2025-38344, CVE-2025-38345, CVE-2025-38346, CVE-2025-38347, CVE-2025-38348, CVE-2025-38349, CVE-2025-38351, CVE-2025-38354, CVE-2025-38361, CVE-2025-38362, CVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368, CVE-2025-38369, CVE-2025-38371, CVE-2025-38373, CVE-2025-38374, CVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38382, CVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387, CVE-2025-38388, CVE-2025-38389, CVE-2025-38390, CVE-2025-38391, CVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396, CVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402, CVE-2025-38403, CVE-2025-38405, CVE-2025-38406, CVE-2025-38407, CVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38412, CVE-2025-38414, CVE-2025-38415, CVE-2025-38416, CVE-2025-38418, CVE-2025-38419, CVE-2025-38420, CVE-2025-38422, CVE-2025-38424, CVE-2025-38425, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429, CVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439, CVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445, CVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456, CVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460, CVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464, CVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468, CVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472, CVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478, CVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483, CVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489, CVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494, CVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499, CVE-2025-38501, CVE-2025-38502, CVE-2025-38503, CVE-2025-38506, CVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512, CVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516, CVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526, CVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530, CVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535, CVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540, CVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546, CVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551, CVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556, CVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38566, CVE-2025-38568, CVE-2025-38569, CVE-2025-38571, CVE-2025-38572, CVE-2025-38574, CVE-2025-38576, CVE-2025-38577, CVE-2025-38578, CVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583, CVE-2025-38584, CVE-2025-38585, CVE-2025-38587, CVE-2025-38588, CVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601, CVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609, CVE-2025-38610, CVE-2025-38612, CVE-2025-38614, CVE-2025-38615, CVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624, CVE-2025-38625, CVE-2025-38626, CVE-2025-38627, CVE-2025-38630, CVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639, CVE-2025-38640, CVE-2025-38643, CVE-2025-38644, CVE-2025-38645, CVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652, CVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663, CVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670, CVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677, CVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684, CVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688, CVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694, CVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698, CVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702, CVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706, CVE-2025-38707, CVE-2025-38708, CVE-2025-38709, CVE-2025-38710, CVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714, CVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721, CVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728, CVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734, CVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676, CVE-2025-39678, CVE-2025-39679, CVE-2025-39681, CVE-2025-39683, CVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687, CVE-2025-39689, CVE-2025-39691, CVE-2025-39692, CVE-2025-39693, CVE-2025-39694, CVE-2025-39697, CVE-2025-39698, CVE-2025-39701, CVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706, CVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711, CVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715, CVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720, CVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730, CVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736, CVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742, CVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747, CVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752, CVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758, CVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763, CVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773, CVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782, CVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790, CVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798, CVE-2025-39800, CVE-2025-39801, CVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39889, CVE-2025-39890, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39946, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39989, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40019, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40215, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40297, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2025-68750)

ubuntu.comMar 25, 2026extracted

USN-8125-1: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; - S390 architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x86 architecture; - Xtensa architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - ATM drivers; - Drivers core; - Block device driver; - Network block device driver; - Bluetooth drivers; - Bus devices; - Hardware random number generator core; - Character device driver; - Data acquisition framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - Device frequency scaling framework; - DMA engine subsystem; - ARM SCMI message protocol; - EFI core; - Intel Stratix 10 firmware drivers; - GPU drivers; - HID subsystem; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - ISDN/mISDN subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Texas Instruments network drivers; - Ethernet team driver; - NVME drivers; - PCI subsystem; - PCCARD (PCMCIA/CardBus) bus subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - ARM PM domains; - PPS (Pulse Per Second) driver; - PTP clock framework; - PWM drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - TCM subsystem; - Trusted Execution Environment drivers; - TTY drivers; - Userspace I/O drivers; - Cadence USB3 driver; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - Xen hypervisor drivers; - AFS file system; - BTRFS file system; - Ceph distributed file system; - File systems infrastructure; - EFI Variable file system; - exFAT file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - GFS2 file system; - HFS file system; - HFS+ file system; - HugeTLB file system; - JFS file system; - KERNFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - OrangeFS file system; - Proc file system; - Diskquota system; - SMB network file system; - SquashFS file system; - UDF file system; - XFS file system; - Asynchronous Transfer Mode (ATM) subsystem; - BPF subsystem; - Mellanox drivers; - NFS page cache wrapper; - Memory management; - Memory Management; - Media input infrastructure; - Bluetooth subsystem; - IP tunnels definitions; - Network traffic control; - Rose network layer; - Network sockets; - io_uring subsystem; - Control group (cgroup); - Kernel crash support code; - Kernel futex primitives; - PID allocator; - Scheduler infrastructure; - Syscalls implementation; - Timer subsystem; - Tracing infrastructure; - 9P file system network protocol; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NFC subsystem; - Open vSwitch; - RF switch subsystem; - SCTP protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - TLS protocol; - VMware vSockets driver; - Wireless networking; - eXpress Data Path; - XFRM subsystem; - Integrity Measurement Architecture(IMA) framework; - Intel ASoC drivers; - QCOM ASoC drivers; - USB sound devices; (CVE-2025-21833, CVE-2025-22037, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-37899, CVE-2025-38105, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734)

ubuntu.comMar 25, 2026extracted

USN-8094-4: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ATM drivers; - Network block device driver; - Bluetooth drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - Device frequency scaling framework; - Intel Stratix 10 firmware drivers; - GPIO subsystem; - GPU drivers; - Microsoft Hyper-V drivers; - CoreSight HW tracing drivers; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Tablet) drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - Texas Instruments network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - Pin controllers subsystem; - x86 platform drivers; - Voltage and Current Regulator drivers; - Real Time Clock drivers; - S/390 drivers; - SCSI subsystem; - Texas Instruments SoC drivers; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - UFS subsystem; - DesignWare USB3 driver; - USB Gadget drivers; - Renesas USBHS Controller drivers; - USB Mass Storage drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Framebuffer layer; - AFS file system; - BFS file system; - BTRFS file system; - EROFS file system; - Ext4 file system; - FAT file system; - GFS2 file system; - Journaling layer for block devices (JBD2); - File systems infrastructure; - Network file system (NFS) client; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - XFS file system; - BPF subsystem; - MediaTek SoC drivers; - Bluetooth subsystem; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Timer subsystem; - Tracing infrastructure; - Kexec HandOver (KHO); - Memory management; - Ceph Core library; - Networking core; - Devlink API; - IPv4 networking; - IPv6 networking; - Multipath TCP; - Open vSwitch; - Network traffic control; - VMware vSockets driver; - eXpress Data Path; - Integrity Measurement Architecture(IMA) framework; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222, CVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228, CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232, CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236, CVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295, CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299, CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307, CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325, CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329, CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333, CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341, CVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349, CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358, CVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372, CVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729, CVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735, CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746, CVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751, CVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-71128)

ubuntu.comMar 25, 2026extracted

USN-8098-8: Linux kernel (Azure FIPS) vulnerabilities

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMar 25, 2026extracted

USN-8098-7: Linux kernel (Azure) vulnerabilities

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - GPIO subsystem; - GPU drivers; - BTRFS file system; - XFRM subsystem; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - SMC sockets; (CVE-2021-47599, CVE-2022-48875, CVE-2022-49072, CVE-2024-49927, CVE-2024-56640, CVE-2025-21780, CVE-2025-40215)

ubuntu.comMar 25, 2026extracted

USN-8121-1: Linux kernel (AWS FIPS) vulnerability

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMar 24, 2026extracted

USN-8098-6: Linux kernel (FIPS) vulnerabilities

Packages linux-fips - Linux kernel with FIPS linux-gcp-fips - Linux kernel for Google Cloud Platform (GCP) systems with FIPS Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; MMC subsystem; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; MMC subsystem; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMar 24, 2026extracted

USN-8098-5: Linux kernel vulnerabilities

Details Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; MMC subsystem; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: x86 architecture; GPIO subsystem; GPU drivers; MMC subsystem; BTRFS file system; XFRM subsystem; IPv4 networking; IPv6 networking; MAC80211 subsystem; SMC sockets Update instructions The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

ubuntu.comMar 24, 2026extracted

RSAC 2026 Conference Announcements Summary (Day 1)

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential product and service updates, along with reports from the first day of the event. A roundup of announcements from the days leading up to the conference is also available. Acalvio has released 360 Deception, a cyber deception framework designed to break AI-driven attack automation. By incorporating 360 Deception into their existing tech stack, organizations will be able to disrupt AI-driven threat campaigns and expose malicious intent before compromise occurs. 360 Deception makes cyber defense dynamic and extends it to real assets. The platform creates a high-uncertainty environment that exposes attackers early by disrupting the stable ground truth that automated attack tools depend on. Application security startup Apiiro announced that it is expanding the power of its AI coding security agent, Guardian Agent, with a new capability to identify security and compliance risks before code is ever written, called AI Threat Modeling. Apiiro AI Threat Modeling generates architecture-aware threat models from specs and tickets, enabling teams to identify and fix risks before code is written. By identifying risks earlier, teams can reduce rework, avoid late-stage delays, and keep development moving without adding new security bottlenecks. Arctic Wolf announces new Aurora platform and agentic SOC Arctic Wolf announced the availability of the new Aurora Superintelligence Platform, designed to accelerate the adoption of AI across cybersecurity. Built on a transformative agentic framework called the Swarm of Experts, the platform helps IT and security teams rapidly and confidently adopt Agentic AI to solve the trust and reliability challenges that have slowed adoption in cybersecurity. Arctic Wolf also announced the availability of the new Aurora Agentic SOC. Built on the Aurora Superintelligence Platform, the Aurora Agentic SOC combines Arctic Wolf’s Concierge Experience with turnkey agentic AI. Arctic Wolf also announced a partnership with cloud security firm Wiz to deliver a new integration between Wiz solutions and the Aurora Superintelligence Platform. ArmorCode, in partnership with the Purple Book Community, released The State of AI Risk Management 2026, highlighting a growing “confidence gap” between perceived AI security readiness and actual operational risk. Based on a survey of more than 650 cybersecurity leaders, the report reveals that while 90% of organizations claim visibility into their AI footprint, 59% admit or suspect shadow AI is operating outside of governance processes. At the same time, 70% report vulnerabilities introduced by AI-generated code already making their way into production environments. Astrix has expanded its platform with a four-method AI agent discovery architecture and a real-time policy engine designed to give security teams full visibility and control over AI agents running across the enterprise. Discovery is handled through four complementary approaches: direct integrations with AI platforms, non-human identity fingerprinting to surface shadow agents authenticating via credentials, telemetry ingested from existing endpoint and network sensors, and a bring-your-own-service option for homegrown or non-standard deployments. A new Agent Policies feature lets security teams define allow, flag, and block rules scoped by user, department, platform, and resource type, evaluated before an agent action executes. BeyondTrust has expanded capabilities across its Pathfinder Platform to deliver a unified approach to securing AI agent coworkers that operate alongside users, as well as autonomous AI workloads executing at scale across cloud and SaaS environments. New capabilities include endpoint privilege enforcement for AI coworkers, AI agent discovery and risk analysis, and secrets management for autonomous agents. The company also announced new threat research from BeyondTrust Phantom Labs, which found that the majority of enterprises are running shadow AI agents with privileged access that security teams cannot see or govern. Black Duck has announced the general availability of Black Duck Signal, an application security solution designed to secure AI-generated code and agentic development workflows. Signal delivers AI-native security designed to reason, validate, and remediate risk at the speed and scale of modern development. Built on an agentic architecture powered by multiple best-in-class LLMs and enhanced by Black Duck’s Context AI, Signal brings contextual security reasoning directly into development workflows. Broadcom has announced Symantec CBX (Carbon Black XDR), a cloud-based platform that merges capabilities from its Symantec and Carbon Black product lines into a single XDR solution. The platform combines Symantec’s prevention, Adaptive Protection, data security, Cloud SWG, and Incident Prediction features with Carbon Black’s EDR technology, providing coverage across endpoints, networks, and data. CBX uses AI to correlate signals across those attack surfaces into high-confidence incidents, and includes an Incident Prediction capability that attempts to forecast an attacker’s next four to five moves. Symantec CBX is expected to be available later this year. Cloud Security Alliance launches CSAI Foundation The Cloud Security Alliance (CSA) has established CSAI, a dedicated 501(c)3 non-profit foundation focused exclusively on AI security and safety, with a stated mission of securing the agentic control plane (covering identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems). CSAI builds on CSA’s existing AI Safety Initiative and will operate six programs: an AI Risk Observatory for threat intelligence and CVE tracking specific to agentic AI; best practices guidance covering identity-first controls, runtime authorization, and privilege governance for non-human actors; education and credentialing including three new TAISE certification tracks; a CxO collaboration program for enterprise security executives; and a global assurance program. Cisco has introduced agent discovery in Identity Intelligence, agentic IAM capabilities in Duo, and Model Context Protocol policy enforcement with adaptive risk protection in Secure Access. These features enable registration of agents mapped to human owners, fine-grained task-based permissions, and routing of tool traffic through an MCP gateway for full visibility and governance. Cisco also released ‘AI Defense: Explorer Edition’ for self-serve red teaming of models and applications, including dynamic adversarial testing against prompt injection and jailbreaks. In addition, the company launched the open-source DefenseClaw framework for automated scanning, inventory, and sandboxing of agent skills and assets, as well as an Agent Runtime SDK for embedding policy enforcement at build time across major frameworks. Commvault announced an expanded integration with Microsoft Security to better connect threat detection with trusted recovery. The new integration uses Microsoft Sentinel, Microsoft Security Copilot, and the Commvault Cloud platform to streamline resilience operations and enable real-time data insights, helping organizations move quickly from identifying a threat to validating and restoring clean data faster with greater confidence. ConductorOne announced its AI Access Management product extension, a unified control plane for managing access to AI tools, agents, and MCP connections across the enterprise. The platform enables organizations to accelerate AI adoption while maintaining full visibility, policy enforcement, and compliance. Cribl has introduced background detection for Cribl Guard, an AI-driven capability that continuously scans in-flight logs, traces, and events to identify previously unknown patterns of PII, secrets, and regulated data. The detection model runs entirely within Cribl Workers, meaning sensitive data is analyzed inside the customer’s own infrastructure rather than being sent to an external service. When a new pattern is detected, findings are surfaced in the Cribl interface with full event context, and security teams can convert a finding into an active Guard rule in a single action. CrowdStrike announced new platform innovations that extend AI agent discovery, shadow AI governance, and runtime threat detection directly from the endpoint – the point of AI execution – to every surface where AI agents operate across SaaS, browser, and cloud environments. CrowdStrike also announced that its Falcon Next-Gen SIEM now ingests and correlates Microsoft Defender for Endpoint telemetry, enabling Microsoft endpoint customers to modernize security operations without deploying additional sensors. CrowdStrike also unveiled native Falcon Onum real-time data pipelines, federated search across third-party data stores, third-party intelligence integration, and its Query Translation Agent. CyberProof announced the availability of CyberProof Defense Center (CDC) Reveal360, a centralized visibility hub that delivers continuous insights into enterprise security posture, service performance, and operational outcomes to help teams understand what their security program is delivering. CDC Reveal360 brings together threat, defense, exposure, and asset estate data from across cloud and security ecosystems into configurable, persona-aligned workspaces that evolve as the environment changes. Dataminr launched Dataminr for Cyber Defense, an agentic AI solution designed to move the SOC from reactive triage to predictive intelligence. By fusing internal telemetry with external signals, the solution autonomously investigates and financially quantifies risk. Dropzone AI has introduced AI Threat Hunter, a new autonomous agent designed to continuously and proactively search for security threats across an organization’s environment without increasing workload. The tool automates complex threat hunting processes, analyzing large datasets, investigating anomalies, and integrating across security platforms. By reducing the time needed to conduct investigations, the AI Threat Hunter expands SOC capabilities, allowing human analysts to focus on higher-value strategic work while improving overall security visibility and response. Fenix24 has debuted Argos99, its asset intelligence and resiliency platform, now available as a standalone SaaS offering. Originally developed by Fenix24’s recovery teams during real-world breach restoration efforts, Argos99 ingests and correlates telemetry from more than 60 cloud and on-prem data sources to deliver real-time visibility into an organization’s assets, how they operate, and how they depend on one another. Argos99 was built from hundreds of real-world incident response engagements to address that exact problem. The platform was reverse engineered by the Fenix24 team using insights gained from breach restoration efforts to both dramatically accelerate ransomware recovery and provide critical resiliency intelligence for organizations who want to invest in their cyber resiliency in advance of an attack. Flashpoint is announcing three new capabilities designed to connect threat intelligence more directly to asset risk and operational workflows. The first is a threat-informed External Attack Surface Management (EASM) module that continuously discovers internet-facing assets and automatically maps them to Flashpoint’s vulnerability intelligence. The second is an in-platform Priority Intelligence Requirements (PIRs) feature that lets teams formally tie alerts, investigations, and reporting to defined business risk priorities. The third is a new anonymous browser within Flashpoint Managed Attribution that provides an isolated environment for investigating underground forums, suspicious links, and threat actor activity. Forcepoint and F5 announced a new alliance to help enterprises secure AI across its lifecycle—from foundational data discovery and classification through runtime protection and continuous assurance. Forcepoint’s AI-native Data Security Posture Management (DSPM) data discovery and classification capabilities combined with F5 AI Red Team and F5 AI Guardrails functionality in the F5 Application Delivery and Security Platform (ADSP) will provide runtime protections for AI applications, APIs, models, and agents help organizations operationalize AI safely while maintaining control and visibility over sensitive enterprise data. Forescout unveils network segmentation capabilities and publishes report Now available within the Forescout 4D Platform, Forescout’s new agentless, cloud-native network segmentation capabilities help organizations model and validate zones based on device identity, function, behavior, and risk. Forescout also published its 2026 Riskiest Connected Devices Report, which shows that network infrastructure now surpasses traditional endpoints in overall risk. Among the topline findings, financial services now has the highest average device risk of any industry — more than three times that observed in retail and significantly higher than government and healthcare. Geordie AI has released a new solution for managing AI agent risk through context engineering. Geordie’s new remediation suite, named Beam, assesses risk and continuously feeds mitigation back to the agent using context-based controls. Google Cloud is debuting a suite of AI-powered security innovations designed to transition organizations toward an ‘Agentic SOC’. These updates integrate frontline threat intelligence directly into autonomous AI agents to automate complex investigation and response tasks. Illumio is delivering new enhancements to Illumio Insights to expand how lateral movement risk is exposed and mitigated, anchored by the introduction of Network Posture. By further enriching its AI security graph, Illumio now delivers system-wide, real-time visibility across hybrid, multi-cloud, and OT environments, surfacing end-to-end attack paths and showing where risk must be prioritized and mitigated. Intel 471’s Cyber Threat Exposure Bundle brings together three core capabilities (Attack Surface Exposure, Third-Party Exposure and Brand Exposure) into a single, intelligence-driven solution on the Verity471 platform. With this unified approach, security teams can close visibility gaps across complex external environments and turn high-fidelity threat intelligence into clearly prioritized remediation actions. The solution continuously discovers internet-facing assets, monitors vendors, detects brand impersonation and applies intelligence-led prioritization by enabling streamlined remediation and more proactive threat management. Keeper Security has officially launched KeeperDB, a new vault-embedded database access capability that enables secure, policy-controlled database interactions directly from the Keeper Vault. KeeperDB enables developers, database administrators and security teams to work with sensitive data through a unified interface that simplifies workflows while maintaining strict access governance. KeeperDB broadens KeeperPAM with a vault-native interface that unifies database session management within the zero-trust and zero-knowledge platform. By embedding database access directly into the Vault, KeeperDB helps reduce credential sprawl, standardize database access workflows and strengthen audit readiness across cloud and on-prem environments. Kiteworks has released Compliant AI, a governance layer that enforces attribute-based access control (ABAC), FIPS 140-3 validated encryption, and tamper-evident audit logging on every AI agent interaction with regulated data, independent of the underlying model, prompt, or agent framework. Controls are applied at the data access layer via four checkpoints: agent authentication, ABAC policy evaluation at the operation level, FIPS 140-3 encryption in transit and at rest, and full audit logging fed directly into the organization’s SIEM. The product ships with three Governed Agent Assists: a Folder Operations Assist for navigating and managing folder hierarchies, a File Management Assist for handling the full data lifecycle in line with retention and disposal requirements, and a Forms Creation Assist for generating governed data collection forms from natural language. Lumu announced new capabilities to its flagship NDR solution. Lumu Defender now extends Continuous Compromise Assessment beyond the network to include endpoints, cloud environments, and user behaviors. Lumu continuously confirms whether an organization is compromised by observing live network activity and validating it against known malicious infrastructure. By linking confirmed malicious communications to identities, endpoints, cloud services, and email, Lumu delivers real-time Continuous Compromise Assessment across the environment. NVIDIA has explained how the new NVIDIA OpenShell runtime is being built to provide tools for controlling autonomous agents in an infrastructure policy layer, adding security in the environment, rather than the model or application layer. Currently in early preview, the OpenShell runtime is being developed as organizations are rapidly defining their strategies for long-running AI agents such as OpenClaw. Instead of relying on behavioral prompts, OpenShell enforces constraints on the environment the agent runs in, so security policies are out of reach of the agent — they’re applied at the system level. Operant AI releases Agent ScopeGuard and launches partnership program Operant AI has released Agent ScopeGuard, a new capability within its Agent Protector product that enforces operational boundaries for AI agents at runtime, blocking out-of-scope actions before they execute. ScopeGuard enforces boundaries at the infrastructure level using GPU-accelerated processing, evaluating every agent action against a defined policy in real time. Security teams can configure per-agent scope policies specifying which data sources, APIs, workflows, and data types each agent is authorized to access or modify. Operant AI also launched an AI Infrastructure Ecosystem Partnership Program, through which the company will integrate its runtime security capabilities directly into the inference stacks of AI infrastructure providers. OmniTrust (formerly Integrity Security Services) has officially launched as an independent entity and unveiled its Trust Lifecycle Management (TLM) platform. The platform unifies device lifecycle management, identity lifecycle management, and TrustAI, a framework for the identity, authorization, and monitoring of autonomous AI models and agents. New global research from OpenText and the Ponemon Institute — titled “Managing Risks and Optimizing the Value of AI, GenAI & Agentic AI” — found that while more than half of organizations have fully or partially deployed gen-AI, fewer than one in five have reached AI maturity (defined as fully deployed AI in cybersecurity with security risks assessed). In addition, fewer than half have a risk-based governance strategy in place to manage what they have already built. Palo Alto Networks introduces new security innovations Palo Alto Networks introduced a new set of security innovations designed to help enterprises safely deploy agentic AI and scale AI‑driven workflows. The company announced Prisma Browser for Business, an AI‑enabled workspace for small businesses that lets teams safely use apps and AI tools from any device while blocking AI‑driven threats; Prisma AIRS 3.0, a new platform designed to secure the full agentic AI lifecycle; Agentic SASE enhancements to Prisma SASE; and Next-Generation Trust Security (NGTS) capabilities to automate certificate lifecycle management and support post-quantum readiness. Qualys has introduced Agent Val into its Enterprise TruRisk Management platform. The new agentic AI layer uses TruConfirm to safely validate exploitability of high-risk exposures directly in production environments, incorporating business context and asset criticality. It then feeds confirmed results back into the platform to prioritize remediation and apply mitigations such as isolation when patching is not possible. After mitigation, Agent Val re-validates to confirm the exploit path is closed. RapidFort has partnered with Nutanix to integrate its software supply chain security capabilities into the Nutanix Kubernetes Platform, enabling enterprises to run secure, compliant Kubernetes environments without slowing development. The combined solution delivers hardened, near-zero CVE container images and automated vulnerability remediation, helping organizations reduce risk while maintaining speed across hybrid and multicloud environments. By extending security across the entire software lifecycle, the partnership allows enterprises to proactively manage vulnerabilities, strengthen compliance, and safely support modern workloads such as AI and generative AI at scale. RSA has added a deploy-anywhere capability to its ID Plus identity and access management platform. The sovereign deployment supports private cloud, multi-cloud, on-premises, and air-gapped environments while delivering unified authentication, SSO, access control, and identity governance. It provides end-to-end phishing-resistant passwordless authentication with offline options, along with RSA Mobile Lock, Risk AI, and Help Desk Live Verify to counter advanced threats and bypass attacks. Rubrik announced its Semantic AI Governance Engine (SAGE), a real-time AI governance engine that enables safe, scalable AI agent deployment with semantic policy interpretation and integrated remediation. SAGE removes the AI agent governance bottleneck by enabling real-time, intent-based control at scale. The company also announced a new integration that combines Microsoft’s identity threat detection with Rubrik’s automated identity rollback and recovery capabilities, helping organizations respond faster to identity-based attacks. SandboxAQ, the $5.75 billion Google spinoff focused on AI and quantum, announced new capabilities on its AQtive Guard platform. These newly added capabilities are designed to help organizations identify and track AI systems in use, apply guardrails, and reduce risks (such as prompt injection, data leakage, and unintended system actions) as these systems become part of day-to-day workflows. SentinelOne launched a new set of AI security capabilities focused on two fronts: securing AI and using AI to automate investigations and response. The updates include giving enterprises visibility and control over autonomous agents, AI red teaming, and one-click, agentic investigations that can analyze threats and trigger remediation in real time. SentinelOne also introduced these capabilities for on-prem and air-gapped environments, enabling highly regulated organizations to adopt AI-driven security. Snyk has unveiled Snyk Agent Security, a new solution designed to secure autonomous AI agents from development through production. The suite addresses shadow AI risks by providing automated discovery, risk intelligence, and policy enforcement within the developer workflow. Key features include the general availability of Evo AI-SPM and new red-teaming tools to protect AI-native applications against prompt injection and data leakage. SOCRadar launched its new AI Agent Marketplace, an integrated hub where organizations can browse, purchase, and deploy specialized autonomous AI agents tailored for specific cybersecurity tasks and use cases in the SOCRadar Extended Threat Intelligence Platform. This includes phishing detection, brand abuse protection, and dark web monitoring. SOCRadar also introduced Identity and Access Intelligence capabilities to its Extended Threat Intelligence Platform to bridge the gap between internal identity security and external exposure. The new capabilities are designed to secure identity blind spots such as credential exposures detected in third-party SaaS environments, dark web marketplaces, and collaboration platforms. Spektion has expanded its platform to perform continuous runtime exposure management. It collects six categories of execution data, including execution state, privilege level, network exposure, blast radius, embedded component vulnerabilities, and pre-CVE weakness patterns, then ranks all exposures by observed exploitability in the specific environment. The platform provides visibility into AI agents, MCP servers, AI-generated executables, custom applications, and embedded libraries that lack CVE coverage, while filtering out non-executing vulnerable software. It also enables early identification of zero-day exploit patterns. Sublime Security announced the general availability of its Autonomous Detection Engineer (ADÉ), an end-to-end AI agent that detects threats and automatically creates or improves detection coverage. ADÉ can run end-to-end without analyst intervention – from picking up a newly reported threat to generating and accepting a high-confidence detection. Other new features include full coverage for spam and graymail, increased transparency, and detection labels. Sysdig has launched runtime security for AI coding agents, enabling organizations to safely adopt autonomous development tools. Sysdig provides the real-time visibility organizations need to monitor agent behavior and identify risky activity across cloud and development environments. Sysdig’s purpose-built runtime detections for AI coding agents help organizations safely adopt agentic tools by identifying risky or suspicious behaviors, such as the installation of new AI coding agents, attempts to open sensitive files or bypass unauthorized credential access, risky command-line arguments that weaken safeguards, and dangerous activity, including reverse shells, binary tampering, and persistence mechanisms. Torq released Agentic Builder, an extension of its AI SOC Platform designed to transform natural language descriptions of security goals into production-grade AI agents and workflows. By shifting the ‘cognitive load’ of engineering from humans to machines, the tool allows security teams to automate complex tasks, including alert triage, investigation, and response. The platform further ensures operational reliability by using the Torq Socrates orchestrator to test, validate, and continuously auto-calibrate these agents against real-world data and evolving threats. Upwind has developed a three-stage pipeline for real-time identification and blocking of malicious prompts sent to large language models. A lightweight classifier first filters incoming traffic to detect LLM-bound requests in under one millisecond with 99.88% accuracy. Identified prompts then undergo semantic analysis using the Nvidia nv-embedcode-7b-v1 model via NIM microservices, achieving 94.53% detection accuracy for prompt injections and indirect jailbreaks in under 0.1 milliseconds. High-risk or uncertain cases escalate selectively to the NVIDIA Nemotron-3-Nano-30B model with NeMo Guardrails for final validation, delivering overall precision near 95% while preserving sub-millisecond end-to-end latency and low cost at production scale. Versa announced early access for Versa Secure Enterprise Browser, a browser-native security capability integrated into the VersaONE Universal SASE Platform that enforces identity-aware, posture-aware, and data-aware policies directly within the browser session. Built on Chromium, it protects employees accessing SaaS, web, and AI applications by governing actions such as file uploads, data copying, and AI tool usage. Versa has also announced a new cloud-delivered capability that extends SSE to inspect and secure inbound internet traffic, collaboration with Intel for AI-driven security, networking, and analytics, and integration between Versa Secure SD-WAN and Zscaler Internet Access. Vorlon has released ‘The Agentic Ecosystem Security Gap: 2026 CISO Report’, a survey of 500 US security leaders that surfaces a troubling contradiction at the heart of enterprise security. Organizations are more confident, more tooled, and more breached than ever, with 99.4% reporting at least one SaaS or AI ecosystem incident in 2025 despite widespread claims of strong or comprehensive protection. The report points to a gap in security architecture, where existing tools lack visibility into the runtime layer of AI agents, integrations, and data movement across the ecosystem. Wiz unveils AI Application Protection Platform and Red Agent Wiz (now part of Google Cloud) launched its AI Application Protection Platform (AI-APP) to secure every layer of AI applications (infrastructure, data, access, models, agents, and applications) from code to runtime. Wiz AI-APP brings together visibility, risk analysis, and runtime protection into a single, graph-powered platform. Wiz also unveiled Red Agent, an AI-powered attacker that acts as a sophisticated security researcher, but with AI speed and scale. Zenity announces AI agent security and OpenClaw security framework Zenity announced two product updates focused on securing AI agents: a new continuous, contextual security model designed to track how risk evolves across agent interactions, and an open-source security framework for OpenClaw that lets developers inspect prompts, evaluate tool use, and analyze outputs before execution.

securityweek.comMar 24, 2026extracted