Ubuntu releases security updates for NVIDIA-specific Linux kernels

Ubuntu has released security updates (USN-9003-1) for its NVIDIA-specific kernel packages, specifically targeting the linux-nvidia-7.0 and linux-nvidia-bos series. These updates are available for Ubuntu 26.04 LTS and 24.04 LTS users running specialized NVIDIA-optimized environments.

The update addresses a significant vulnerability (CVE-2023-20585) affecting AMD processors, where improper Reverse Map Table (RMP) checks during IOMMU access could allow a local attacker with hypervisor privileges to compromise SEV-SNP guest memory integrity. Beyond this specific flaw, the release patches numerous vulnerabilities across a vast array of kernel subsystems, including architectures, drivers, and file systems.

Vulnerability scope and affected subsystems

• AMD SEV-SNP Security: Addresses CVE-2023-20585, which involves an out-of-bounds condition triggered by improper RMP checks when the IOMMU accesses host buffers on certain AMD processors.
• Architecture Support: Patches include fixes for ARM64, ARM32, MIPS, OpenRISC, PowerPC, RISC-V, and S390 architectures, as well as x86 platform drivers.
• Storage and File Systems: Corrects flaws in the BTRFS, Ext4, F2FS, NTFS3, Ceph, and NFS subsystems, along with NVMe, SCSI, and various block device drivers.
• Networking and Virtualization: Includes security fixes for the IOMMU subsystem, Virtio drivers, Xen hypervisor drivers, and various network protocols including IPv4, IPv6, and TCP.
• Hardware Drivers: Addresses vulnerabilities in the Intel NPU driver, GPU drivers, Bluetooth, USB core, and various CXL (Compute Express Link) drivers.

Why it matters

This update is critical for users of Ubuntu-based systems utilizing NVIDIA hardware or specialized NVIDIA-optimized kernels, particularly in cloud or virtualized environments using AMD SEV-SNP. System administrators must prioritize these updates to prevent potential guest memory compromise and ensure the stability of diverse hardware architectures ranging from RISC-V to x86.