On this page (7 sections)

On 3 November 2026 Ubuntu published USN-8961-1, a Linux kernel security notice for Ubuntu 22.04 LTS and 20.04 LTS. It covers the main kernel package and many variants, including AWS, Azure, GCP, GKE, IBM, Oracle, KVM, FIPS, low latency and real-time kernels.

If you run websites or applications on Ubuntu servers, VPS instances or cloud images from those families, this is a routine but important kernel update. The flaw named in the notice is a local issue (an attacker needs access to the machine), so the risk is highest on shared hosts, container hosts and servers where untrusted users or code can run.

What the notice covers

The part of USN-8961-1 that names a specific flaw is CVE-2022-1205. Ubuntu credits Duoming Zhou with discovering race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. Ubuntu says a local attacker could possibly use this to cause a denial of service (system crash).

The notice also states that several other security issues were discovered in the kernel and that an attacker could possibly use these to compromise the system. It lists a very long set of affected subsystems, including networking core, file systems, USB, Bluetooth, GPU drivers and many architecture-specific components. The excerpt available to us does not break those down into individual CVEs, so read the full notice for the complete list.

Two sibling notices were published the same day for specialized kernels: USN-8962-1 for Azure CVM systems (22.04 LTS) and USN-8963-1 for NVIDIA Tegra systems. The Tegra notice additionally names CVE-2022-3114, an i.MX clock driver flaw.

Technical background: the AX.25 flaw

AX.25 is a protocol for amateur radio networking, and Linux ships a kernel implementation of it. According to the CVE record (NVD data) for CVE-2022-1205, it is a NULL pointer dereference in the AX.25 code that a local user can trigger when connecting with the protocol, crashing the system. The record carries a CVSS score of 4.7 (medium) and is tagged with CWE-416 (use after free) and CWE-476 (NULL pointer dereference). The same record lists a Red Hat page among its references; we did not have the content of that page, so we do not rely on it here.

Note that the sources frame the bug differently. The CVE description says NULL pointer dereference, while Ubuntu describes race conditions leading to use-after-free. Both agree on the practical impact: a local user can crash the system. The CWE tags on the record cover both weakness types.

What follows is our reading of the upstream patches, not an official description. The fixes (one, two) add synchronous deletion of the connection's timers during socket release and device teardown, and reorder the disconnect step relative to clearing the device pointer. That pattern is consistent with a timing problem, where timers could run after the structures they depend on were released.

Use-after-free bugs can in some cases lead to more than a crash. For this CVE, however, both the CVE record and Ubuntu describe the impact as a denial of service by a local user, and the sources reviewed do not report any wider impact or any exploitation in the wild.

About CVE-2022-3114

CVE-2022-3114 is a NULL pointer dereference in the i.MX clock driver (imx_register_uart_clocks), where the return value of a memory allocation was not checked. It has a CVSS 3.1 base score of 5.5 (medium) per the GitHub advisory, with local attack vector and high availability impact. In the material reviewed, it is named in the Tegra notice, not in the excerpt of USN-8961-1. It mainly matters for i.MX-based ARM hardware.

Who is realistically exposed

  • Shared hosting and multi-tenant servers where customers can run their own code or shell sessions.
  • Container hosts and CI runners, where untrusted workloads share one kernel.
  • Any Ubuntu 22.04 or 20.04 server where a web application compromise could give an attacker a local foothold. A kernel flaw then becomes a second stage.
  • Single-purpose servers with no untrusted local users face lower risk from the local-only CVE, but the notice lists many other fixes, so they should still update on a normal patch schedule.
AX.25 is rarely used on web servers. Whether the code is available on your system depends on your kernel build and configuration, and the sources reviewed give no mitigation other than updating the kernel. Do not assume you are safe because you never use amateur radio.

How to check your systems

First confirm your Ubuntu release and the kernel you are currently running. These read-only commands print the release and the running kernel version; compare the kernel against the package versions listed in the full USN-8961-1 notice for your kernel flavor.

Show Ubuntu release and running kernel (Ubuntu)Shell
lsb_release -a
uname -r

Next, list installed kernel packages and check whether updates are pending. Both commands only read package state; look for linux-image entries marked upgradable.

List installed kernel images and pending upgrades (Ubuntu)Shell
dpkg -l 'linux-image*' | grep ^ii
apt list --upgradable 2>/dev/null | grep -i linux

What to do now

Kernel updates only take effect after a reboot, so plan a maintenance window. Updating the package alone does not protect a machine that is still running the old kernel.

Caution. Rebooting interrupts every site and service on the host. Schedule it, notify stakeholders, and make sure services start automatically after boot before you restart a production server.

This standard apt sequence refreshes package lists and installs available updates, including kernel packages. Run it with sudo on each Ubuntu 22.04 or 20.04 server.

Install pending updates including the kernel (Ubuntu)Shell
sudo apt update
sudo apt upgrade

After the reboot, confirm the new kernel is running. The output of uname -r should differ from the one you recorded earlier and match a version from the notice for your flavor.

Reboot, then verify the running kernel (Ubuntu)Shell
sudo reboot
# after the server comes back:
uname -r

Monitoring after patching

Kernel patching is one layer. Since the named flaw needs local access, also watch for the ways attackers get that access: compromised web applications, weak SSH credentials and outdated plugins. Check authentication logs for unexpected logins and review which users have shell access.

From the outside, you can monitor certificates, DNS and uptime so that a crash or unplanned reboot is noticed quickly; Webforta Monitor covers uptime and certificate changes. Our guide on uptime monitoring explains what to alert on.

What we could not confirm

  • The exact fixed package version numbers: the notice excerpt reviewed lists affected packages but not version strings. Check the full notice or apt for your flavor.
  • A per-CVE breakdown of the many other kernel issues the notice mentions.
  • Any exploitation in the wild: none is stated in the sources reviewed.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. ax25: Fix UAF bugs in ax25 timers · torvalds/linux@82e3175github.com
  2. ax25: Fix NULL pointer dereferences in ax25 timers · torvalds/linux@fc6d01fgithub.com
  3. CVE-2022-3114 - GitHub Advisory Databasegithub.com
  4. USN-8961-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntuubuntu.com ·
  5. USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities | Ubuntu security notices | Ubuntuubuntu.com ·
  6. USN-8962-1: Linux kernel (Azure CVM) vulnerabilities | Ubuntu security notices | Ubuntuubuntu.com ·
  • Ubuntu
  • Linux kernel
  • USN
  • CVE-2022-1205
  • patching