Ubuntu releases security updates for NVIDIA Tegra Linux kernels

Ubuntu has issued security notices (USN-8963-1) to address multiple vulnerabilities within the Linux kernel, specifically targeting NVIDIA Tegra systems. The update covers the linux-nvidia-tegra and linux-nvidia-tegra-igx kernel packages, which are utilized in embedded and industrial environments.

Two specific vulnerabilities are highlighted: a use-after-free flaw in the AX.25 amateur radio protocol and a null pointer dereference in the i.MX clock driver. These flaws could allow local attackers to trigger system crashes, resulting in a denial of service. The update also patches a wide array of subsystems across various architectures including ARM64, x86, and RISC-V.

Vulnerability details and subsystem coverage

• AX.25 Protocol: A race condition discovered by Duoming Zhou in the AX.25 amateur radio implementation leads to use-after-free vulnerabilities (CVE-2022-1205), potentially causing system crashes.
• i.MX Clock Driver: Improper handling of memory allocation failures in the i.MX clock driver can result in a null pointer dereference (CVE-2022-3114), enabling local denial of service attacks.
• Broad Subsystem Impact: The security patches extend to a massive list of components including the Networking core, USB Gadget drivers, Cryptographic API, and the Block layer subsystem.
• Architecture Support: The fixes impact diverse hardware architectures including ARM32, ARM64, MIPS, OpenRISC, PowerPC, RISC-V, S390, and x86.

Why it matters

This update is critical for users of NVIDIA Tegra-based embedded systems and industrial IGX platforms that rely on Ubuntu LTS releases. Because the vulnerabilities affect core drivers and networking protocols, failure to patch could compromise the stability of mission-critical hardware and edge computing devices.