# Ubuntu HWE kernel update patches 90 CVEs across architectures and subsystems

> **Key takeaway:** Ubuntu's Hardware Enablement kernel update addresses 90 CVEs spanning CPU architectures, networking, storage, USB, audio, GPU drivers, and core kernel infrastructure.

**Published:** 2026-11-12T16:32:50+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-hwe-kernel-update-patches-90-cves-across-architecture.html 

## Summary
Canonical has released USN-9018-2, a security update for the Ubuntu Linux Hardware Enablement (HWE) kernel that patches 90 tracked vulnerabilities. The flaws affect an exceptionally broad range of subsystems including ARM64, PowerPC, RISC-V, S390, x86, and User-Mode Linux architectures; block layer, NVMe, and multiple file systems including BTRFS, XFS, and SMB; networking components from IPv4/IPv6 and Netfilter to Bluetooth, WiFi, and InfiniBand; and dozens of driver categories spanning GPU, HID, USB, SCSI, TPM, and audio codecs.

The update covers kernel packages for supported Ubuntu releases using the HWE stack, which provides newer kernels on LTS releases. Attack vectors include local privilege escalation, remote code execution through network file systems and drivers, information disclosure via side channels, and denial of service through malformed input to stream parsers, BPF, io_uring, and memory management subsystems. Users running Ubuntu with HWE kernels on server, desktop, or cloud instances will receive this through standard apt updates.

## Subsystem and architecture coverage in USN-9018-2
- **Architecture scope:** Vulnerabilities span ARM64, PowerPC, RISC-V, S390, x86, and User-Mode Linux, indicating flaws in both platform-specific code and architecture-agnostic paths.
- **Storage and file systems:** Patches touch the block layer, NVMe drivers, BTRFS, XFS, SMB network file system, and file systems infrastructure, with potential for data corruption or privilege escalation.
- **Networking breadth:** Fixes cover Netfilter, IPv4/IPv6 stack, Bluetooth subsystem, MAC80211 wireless, Ethernet bonding/team drivers, Mellanox and MediaTek network drivers, Open vSwitch, packet sockets, SCTP, SMC, TIPC, and VMware vSockets.
- **USB and device connectivity:** Extensive driver updates across USB core, USB3/2 host controllers (Cadence, DesignWare), USB Gadget, USB Serial, USB Mass Storage, USB Type-C and Power Delivery, and Thunderbolt/USB4.
- **Kernel internals:** BPF subsystem, io_uring, futex primitives, fork() syscall, KProbes, tracing infrastructure, workqueues, memory management, cgroups, and SELinux all received security fixes.

## Why it matters
This HWE kernel update demonstrates the sustained maintenance burden of shipping newer kernels on Ubuntu LTS releases, a pattern other distributions including Fedora and Debian backports also manage. System administrators running Ubuntu servers or workstations with HWE enabled should prioritize this update given the remote exploitability of several network and file system paths. The breadth of affected CVEs also underscores the value of automated security tracking for Linux distributions serving cloud and enterprise workloads.