On this page (6 sections)
Ubuntu has published USN-8968-1, a Linux kernel security notice dated 3 November 2026. It covers Ubuntu 14.04 LTS (trusty) and references two older kernel flaws: CVE-2021-3640, a Bluetooth use-after-free, and CVE-2022-49058, a buffer overflow in the CIFS symlink handling code.
If you still run a 14.04 server, for example a legacy web host or a forgotten virtual machine, this notice is relevant to you. Both flaws are local issues, so the main risk is an attacker who already has some foothold on the machine.
What the notice covers
Ubuntu says several security issues were fixed in the Linux kernel. It names two CVEs in its references: CVE-2021-3640 and CVE-2022-49058. For the first, the notice describes a use-after-free in the Bluetooth subsystem that a local attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code. For the file systems infrastructure subsystem, it only says that an attacker could possibly use the flaws to compromise the system.
The notice lists only Ubuntu 14.04 LTS. The fixed packages are marked as available through Ubuntu Pro via the Legacy Support add-on, so a plain free 14.04 install may not receive them.
Technical details of the two flaws
CVE-2021-3640: Bluetooth use-after-free
According to the GitHub advisory, the flaw is in sco_sock_sendmsg() in the kernel's HCI subsystem. A race condition between sco_conn_del() and sco_sock_sendmsg() can leave the kernel using memory after it has been freed. The advisory states that a privileged local user could crash the system or escalate privileges. It maps to CWE-362 (race condition) and CWE-416 (use after free).
The CVSS v3.1 vector is AV:L/AC:H/PR:L/UI:N, scoring 7.0. In plain terms: the attacker must be local, needs some privileges, and the timing makes it hard to pull off. The same advisory gives an EPSS score of 0.37%, an estimate of exploitation probability over 30 days.
CVE-2022-49058: CIFS symlink buffer overflow
The GitHub advisory describes a potential buffer overflow when the cifs code handles symlinks. A length value parsed with sscanf() was not checked against the size of the destination buffer, and the fix adds that check. It maps to CWE-120 (classic buffer overflow).
Scores differ by source. The CVE record data supplied for this story lists 9.1 critical, while the GitHub advisory shows 7.8 High with the vector AV:L/AC:L/PR:L/UI:N. Treat the two numbers as a scoring disagreement, not as two different bugs. The GitHub advisory gives an EPSS score of 0.874%.
Who is realistically exposed
- Servers still running Ubuntu 14.04 LTS, which is long past standard support and only patched through the Legacy Support add-on.
- Shared hosting, build servers and multi-user machines, where untrusted local users or compromised web applications could attempt local privilege escalation.
- Systems that use CIFS/SMB mounts, which is where the symlink handling code applies. The research does not say exactly which configurations are reachable, so do not assume you are safe without the kernel update.
Both flaws require local access. A remote visitor to your website cannot trigger them directly, but a vulnerable web application that gives an attacker a low-privilege shell turns a local kernel bug into a path to full control.
How to check your exposure
Run this on the server to print the release version. You are looking for 14.04.
lsb_release -aNext, show the running kernel. The fixed trusty kernel is 3.13.0-219, so anything older means you have not booted into the update.
uname -rThen list the installed kernel image packages and compare them with the fixed versions in the notice.
dpkg -l 'linux-image*' | grep ^iiWhat to do now
Ubuntu's update instructions say a standard system update is needed, followed by a reboot so the changes take effect.
sudo apt update && sudo apt upgradesudo reboot0 of 6 done
Detection and monitoring afterwards
Kernel patches do not tell you whether someone already used a local flaw. Review authentication logs for unfamiliar logins, check for unexpected new users or SUID files, and watch for unexplained crashes or reboots, since a use-after-free can show up as a kernel panic. For the website side, a read-only security scan and our guide on how to check if a website is hacked help you spot signs of compromise on the web layer.
Webforta's monitoring can also alert you to uptime changes, which is useful for noticing unplanned reboots on an aging server. If you find evidence of a breach, follow website hacked: what to do.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.