Ubuntu releases kernel security updates for multiple architectures and subsystems

Ubuntu has published security notice USN-8961-1 to address several vulnerabilities discovered within the Linux kernel. These flaws affect a wide range of environments, including standard desktop installations, cloud-optimized kernels for AWS, Azure, and GCP, and specialized real-time or low-latency builds.

One specific vulnerability, CVE-2022-1205, involves race conditions in the AX.25 amateur radio protocol implementation. This flaw can lead to use-after-free errors, potentially allowing a local attacker to trigger a system crash and cause a denial of service. The update provides patches for various architectures including x86, ARM64, RISC-V, and PowerPC.

Vulnerability scope and affected subsystems

• AX.25 Protocol Flaw: CVE-2022-1205 identifies race conditions in the amateur radio protocol implementation that result in use-after-free vulnerabilities.
• Architecture Coverage: The security patches impact a broad spectrum of hardware architectures, including x86, ARM32, ARM64, OpenRISC, PowerPC, RISC-V, and S390.
• Subsystem Impact: Fixes extend across critical kernel areas including the networking core, block layer, USB gadget drivers, IOMMU, and the BPF subsystem.
• Filesystem Security: The update addresses vulnerabilities within various filesystem infrastructures such as BTRFS, Ext4, F2FS, XFS, and the Network File System (NFS) client and server.

Why it matters

This update is critical for Ubuntu LTS users (20.04 and 22.04) and cloud administrators running specialized kernels on AWS, Azure, or Google Cloud. Because the fixes touch core subsystems like networking, storage, and architecture-specific code, system administrators should prioritize these updates to prevent local privilege escalation or denial-of-service attacks.