USN-8959-1: Ubuntu Linux Kernel Security Update Guide

Ubuntu released USN-8959-1 on 3 November 2026. It is a Linux kernel security notice, and Ubuntu warns that an attacker could possibly use the fixed flaws to compromise a system. A second notice, USN-8960-1, covers the OEM kernel on Ubuntu 26.04 LTS.

Anyone running Ubuntu 26.04 LTS or 24.04 LTS on web servers, cloud instances or hosting nodes should plan this update. The notice text available to us has no CVE identifiers, severity scores or exploitation details, so this article limits itself to what Ubuntu states.

What the notice covers

This is a collection of kernel fixes, not one bug. According to the Ubuntu notice, the corrected flaws sit in a very large number of kernel areas. Broadly they fall into three groups:

• Central kernel code, such as memory management, the networking core, eXpress Data Path, the block layer, the crypto API and the EROFS file system
• Code specific to a CPU architecture, including ARM, x86, RISC-V, S390 and PowerPC
• A long tail of device drivers, among them USB gadget, Bluetooth, GPU, NVMe, SCSI, Hyper-V and several network adapter drivers

The notice does not say which of these flaws are reachable on a given machine, whether they need local access, or whether any can be triggered remotely. Whether a particular driver is loaded on your host is something you would need to check yourself.

Who is exposed

The notice lists six kernel packages, each tied to a kernel flavor:

A server on Ubuntu 26.04 LTS or 24.04 LTS running one of these kernels is in scope. OEM systems on 26.04 LTS are handled by USN-8960-1. As a general prioritization rule, not something the notice states, hosts where untrusted users or workloads run code, such as shared hosting, container hosts and multi-tenant servers, deserve the earliest maintenance window.

How to check your servers

Start by identifying the running kernel. This read-only command pair prints the kernel version and the Ubuntu release.

uname -r
lsb_release -a

Then list the installed kernel image packages. The output shows which flavor you use, so you can compare its version with the fixed one on the USN page.

dpkg -l 'linux-image*' | grep ^ii

To see whether a kernel update is waiting, refresh package lists and filter the upgradable packages. This only lists candidates and installs nothing.

sudo apt update
apt list --upgradable 2>/dev/null | grep linux

What to do now

This command installs all pending updates, including the kernel package for your flavor. It does not reboot the machine.

sudo apt update
sudo apt upgrade

Once the update is installed, restart the host and confirm the running kernel matches the fixed version for your release.

sudo reboot
# after the host is back:
uname -r

Monitoring after patching

After the restart, watch for unexpected reboots, failed services and kernel errors, and skim authentication and process logs around the maintenance window. If a host ran an unpatched kernel while untrusted users had access, review it as you would any possible compromise, starting with our guide on what to do if a website is hacked.

A kernel patch does not cover application-level problems. Webforta Scan runs read-only checks of your public site and Webforta Monitor tracks certificate and DNS changes, but neither tells you whether a server's kernel is patched. More background is in the security guides hub.

Timeline

• 3 November 2026: Ubuntu publishes USN-8959-1 for 26.04 LTS and 24.04 LTS, and USN-8960-1 for the OEM kernel on 26.04 LTS

Only Ubuntu's own notices were available when this was written. Neither claims exploitation in the wild, and no independent source confirms it, so treat exploitation status as unknown.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

1. USN-8959-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntuubuntu.com · 3 November 2026
2. USN-8960-1: Linux kernel (OEM) vulnerabilities | Ubuntu security notices | Ubuntuubuntu.com · 3 November 2026

• Ubuntu
• Linux kernel
• USN
• patching
• servers