Ubuntu releases kernel security updates addressing multiple io_uring and subsystem flaws

Ubuntu has published security notice USN-9020-1 to address a wide range of vulnerabilities across the Linux kernel. The update specifically targets several flaws within the io_uring subsystem that could allow local attackers to cause system hangs, crashes, or memory exhaustion.

Beyond io_uring, the security patches cover a massive array of kernel components including architecture-specific code for x86, ARM64, RISC-V, and MIPS, as well as various hardware drivers. These updates are essential for maintaining system stability and preventing potential privilege escalation or denial-of-service attacks across diverse hardware platforms.

Technical breakdown of kernel vulnerabilities

• io_uring Subsystem: Multiple CVEs addressed include CVE-2026-80811 (memory leak leading to DoS), CVE-2026-81009 (improper query request validation causing system hangs), and CVE-2026-81010 (incorrect task context handling during canceled work leading to crashes).
• Network and Buffer Management: CVE-2026-97618 addresses a flaw where improper tracking of truncated network messages in io_uring could allow a remote attacker to corrupt application receive buffers.
• Architecture and Driver Coverage: The update patches vulnerabilities spanning multiple architectures (ARM64, ARM32, x86, RISC-V, MIPS, PowerPC, S390, etc.) and critical subsystems including eXpress Data Path (XDP), Memory Management, and the Block Layer.
• Hardware-Specific Fixes: Security improvements were applied to a vast list of drivers including Intel NPU, AMD CDX bus, Microsoft Hyper-V, NVMe, and various networking controllers from Mellanox, MediaTek, and Texas Instruments.

Why it matters

This update is critical for Ubuntu users running high-performance asynchronous I/O workloads, as the io_uring fixes directly impact system reliability. Because the patches cover such a broad spectrum of architectures and drivers, system administrators must ensure kernel updates are applied to maintain security across heterogeneous server and embedded environments.