========================================================================== Ubuntu Security Notice USN-8223-1 April 29, 2026 roundcube vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Roundcube Webmail. Software Description: - roundcube: skinnable AJAX based webmail solution for IMAP servers - metapackage Details: It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names. An attacker could possibly use this issue to cause a homograph attack. (CVE-2019-15237) It was discovered that Roundcube Webmail did not properly sanitize certain attributes when handling CSS within HTML messages and certain SVG attributes. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-38356, CVE-2024-38357) It was discovered that Roundcube Webmail did not properly sanitize certain HTML attributes when rendering e-mail messages. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2024-42008) It was discovered that Roundcube Webmail did not properly filter certain CSS token sequences within rendered e-mail messages. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-42010) It was discovered that Roundcube Webmail did not properly treat an SVG tag as an image source within its HTML sanitizer. An attacker could possibly use this issue to bypass remote image blocking to track email open actions or potentially bypass access control. (CVE-2026-25916) It was discovered that Roundcube Webmail did not properly handle comments within Cascading Style Sheets (CSS). An attacker could possibly use this issue to perform a CSS injection attack. (CVE-2026-26079) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS roundcube-core 1.6.6+dfsg-2ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 22.04 LTS roundcube-core 1.5.0+dfsg.1-2ubuntu0.1~esm6 Available with Ubuntu Pro roundcube-plugins 1.5.0+dfsg.1-2ubuntu0.1~esm6 Available with Ubuntu Pro Ubuntu 20.04 LTS roundcube-core 1.4.3+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro roundcube-plugins 1.4.3+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro Ubuntu 18.04 LTS roundcube-core 1.3.6+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro roundcube-plugins 1.3.6+dfsg.1-1ubuntu0.1~esm8 Available with Ubuntu Pro Ubuntu 16.04 LTS roundcube-core 1.2~beta+dfsg.1-0ubuntu1+esm8 Available with Ubuntu Pro roundcube-plugins 1.2~beta+dfsg.1-0ubuntu1+esm8 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8223-1 CVE-2019-15237, CVE-2024-38356, CVE-2024-38357, CVE-2024-42008, CVE-2024-42010, CVE-2026-25916, CVE-2026-26079
Wednesday, April 29, 2026
[USN-8198-2] Tornado vulnerabilities
========================================================================== Ubuntu Security Notice USN-8198-2 April 28, 2026 python-tornado vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS Summary: Several security issues were fixed in Tornado. Software Description: - python-tornado: scalable, non-blocking web server and tools Details: USN-8198-1 fixed vulnerabilities in Tornado. This update provides the corresponding updates for Ubuntu 26.04 LTS. Original advisory details: It was discovered that Tornado incorrectly handled parsing of large multipart request bodies. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-31958) It was discovered that Tornado did not properly validate characters in cookie values. An attacker could possibly use this issue to inject arbitrary cookie attributes. (CVE-2026-35536) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-tornado 6.5.4-0.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8198-2 https://ubuntu.com/security/notices/USN-8198-1 CVE-2026-31958, CVE-2026-35536 Package Information: https://launchpad.net/ubuntu/+source/python-tornado/6.5.4-0.1ubuntu0.1
[USN-8221-1] wheel vulnerability
========================================================================== Ubuntu Security Notice USN-8221-1 April 29, 2026 wheel vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: wheel could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - wheel: Command line tool for manipulating Python wheel files Details: It was discovered that wheel did not correctly handle certain file paths. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS python-wheel-common 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro python3-wheel 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro python3-wheel-whl 0.42.0-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8221-1 CVE-2026-24049
[USN-8195-3] PackageKit vulnerability
========================================================================== Ubuntu Security Notice USN-8195-3 April 29, 2026 packagekit vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: PackageKit could be made to install packages as the administrator. Software Description: - packagekit: Provides a package management service Details: USN-8195-1 fixed a vulnerability in PackageKit. This update provides the corresponding fix to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PackageKit incorrectly handled certain transactions. A local attacker could use this issue to install arbitrary packages as root, possibly resulting in privilege escalation. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS packagekit 1.1.13-2ubuntu1.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS packagekit 1.1.9-1ubuntu2.18.04.6+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS packagekit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8195-3 https://ubuntu.com/security/notices/USN-8195-2 https://ubuntu.com/security/notices/USN-8195-1 CVE-2026-41651
F45 Change Proposal: Versioned_libgit2_packages [SystemWide]
Discussion Thread: https://discussion.fedoraproject.org/t/189891
**This is a proposed Change for Fedora Linux.**
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.
== Summary ==
Going forward, only fully versioned packages for libgit2 will be provided. Dependent libraries and applications are adapted to build and link with the specific libgit2 version they support, and the version-less package names will no longer be provided.
== Owner ==
* Name: [[User:Decathorpe| Fabio Valentini]]
* Email: decathorpe AT gmail DOT com
== Detailed Description ==
Both major and minor versions of libgit2 bring ABI and / or API changes, so applications and libraries that link libgit2 need to be rebuilt for new versions. Using fully versioned package names (or version ranges on pkgconfig dependency specs), packages are adapted to build with the specific libgit2 version they support.
By providing fully versioned package names, it will be possible to introduce newer libgit2 versions to older Fedora releases (and eventually EPEL) transparently and without breaking existing dependencies. As applications are adpated to new libgit2 versions, the oldest provided versions will eventually become unused and can be dropped from Fedora.
* libgit2 (currently v1.9 in Fedora): will be retired
* libgit2_1.9: newly introduced, obsoleting the unversioned package names
* libgit2_1.8: already exists
When libgit2 v2.0.0 is released, it will be packaged as either `libgit2_2.0` or `libgit2_2`, depending on whether libgit2 upstream can finally commit to avoiding ABI changes in minor versions or not.
It is planned to eventually make equivalent changes in EPEL 10 and 9 in order to be able to introduce new parallel-installable libgit2 versions there too.
== Feedback ==
N/Y
== Benefit to Fedora ==
Historically, updates for libgit2 have been tricky due to handle due to frequent ABI changes even in minor versions. Applications that built and worked fine with one version of libgit2 might be subtly broken when built with a different minor version. The corresponding Python bindings (python-pygit2) and bindings for other languages would need to be updated at the same time to avoid even more subtle breakage. Since core build system components like rpmautospec utilize pygit2, issues quickly had a large impact.
By providing fully versioned and parallel-installable packages for different libgit2 versions by default in the future, dependent libraries, applications, and language bindings can be explicitly moved to the next version when things are ready and tested. It also allows introducing newer versions of libgit2 - which often contain fixes for security issues - to older Fedora releases (and eventually, EPEL) transparently without breaking dependent packages.
== Scope ==
* Proposal owners:
Import new libgit2_1.9 package, providing libgit2 v1.9.
Adapt package dependencies to move away from unversioned dependencies.
Retire unversioned libgit2 package from Fedora Rawhide / 45+.
* Other developers:
Adapt package dependencies to move away from unversioned dependencies.
Pull requests for packages where the Change owner is not a co-maintainer will be provided by the Change owner(s).
* Release engineering: [https://forge.fedoraproject.org/releng/tickets/issues/13325 #13325]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
On upgrade, existing installs will be migrated from unversioned libgit2 packages to the versioned equivalents (currently, that would be libgit2_1.9). No actual impact for users is expected.
== Early Testing (Optional) ==
N/A
Do you require 'QA Blueprint' support? Y/N
== How To Test ==
Upgrading to Fedora 45 should remove the libgit2 package and transparently replace it with libgit2_1.9. Packages built against libgit2 v1.9 should depend on libgit2_1.9, and packages built against libgit2 v1.8 should depend on libgit2_1.8, and both should be parallel-installable.
== User Experience ==
No impact to user experience is expected.
== Dependencies ==
**libgit2**:
* R-gert
* R-git2r
* foundry (libfoundry)
* geany-plugins (geany-plugins-git-changebar, geany-plugins-workbench)
* git-evtag
* gnome-builder
* gnuastro
* julia
* kicad
* kommit
* kup-backup
* libgit2-glib
* nix (nix-libs)
* python-pygit2 (python3-pygit2)
* python-rpmautospec (rpmautospec, python3-rpmautospec)
* rpm-git-tag-sort
* rubygem-rugged
* rust (cargo)
* siril
**libgit2-devel** only:
* calligra
* goose
* kf5-ktexteditor
* kf6-ktexteditor
* public-inbox
* ruyi
== Contingency Plan ==
* Contingency mechanism:
If dependent packages cannot be adapted in time, retirement of the unversioned libgit2 package can be postponed to a later release. The package adaptations themselves are backwards compatible and do not need to be reverted.
* Contingency deadline:
Final Freeze
* Blocks release?
No
== Documentation ==
N/A
== Release Notes ==
\nDifferent libgit2 minor versions will all be provided as fully-versioned, parallel-installable packages in order to ensure easy upgrades and migration paths for dependent applications, libraries, and language bindings. The un-versioned libgit2 packages (libgit2, libgit2-devel) were dropped.
-- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[USN-8087-3] python-cryptography vulnerability
========================================================================== Ubuntu Security Notice USN-8087-3 April 28, 2026 python-cryptography vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: python-cryptography could be made to expose sensitive information over the network. Software Description: - python-cryptography: Cryptography Python library Details: USN-8087-1 fixed a vulnerability in python-cryptography. This update provides the corresponding update to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A remote attacker could use this issue to perform a subgroup attack and possibly recover the least significant bits of private keys. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS python-cryptography 2.8-3ubuntu0.3+esm2 Available with Ubuntu Pro python3-cryptography 2.8-3ubuntu0.3+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS python-cryptography 2.1.4-1ubuntu1.4+esm3 Available with Ubuntu Pro python3-cryptography 2.1.4-1ubuntu1.4+esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS python-cryptography 1.2.3-1ubuntu0.3+esm3 Available with Ubuntu Pro python3-cryptography 1.2.3-1ubuntu0.3+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8087-3 https://ubuntu.com/security/notices/USN-8087-2 https://ubuntu.com/security/notices/USN-8087-1 CVE-2026-26007
[USN-8224-1] Linux kernel (BlueField) vulnerabilities
========================================================================== Ubuntu Security Notice USN-8224-1 April 29, 2026 linux-bluefield vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-bluefield: Linux kernel for NVIDIA BlueField platforms Details: Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - x86 architecture; - Cryptographic API; - GPU drivers; - I2C subsystem; - BTRFS file system; - XFRM subsystem; - Padata parallel execution mechanism; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Netfilter; - Network traffic control; - SMC sockets; (CVE-2021-47599, CVE-2022-48875, CVE-2022-49046, CVE-2022-49698, CVE-2024-46816, CVE-2024-49927, CVE-2024-56640, CVE-2025-21726, CVE-2025-21780, CVE-2025-37849, CVE-2025-40019, CVE-2025-40215, CVE-2026-23060, CVE-2026-23074) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS linux-image-5.4.0-1116-bluefield 5.4.0-1116.123 Available with Ubuntu Pro linux-image-bluefield 5.4.0.1116.112 Available with Ubuntu Pro linux-image-bluefield-5.4 5.4.0.1116.112 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-8224-1 https://launchpad.net/bugs/2143853 CVE-2021-47599, CVE-2022-48875, CVE-2022-49046, CVE-2022-49698, CVE-2024-46816, CVE-2024-49927, CVE-2024-56640, CVE-2025-21726, CVE-2025-21780, CVE-2025-37849, CVE-2025-40019, CVE-2025-40215, CVE-2026-23060, CVE-2026-23074, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411,
[USN-8217-1] follow-redirects vulnerabilities
========================================================================== Ubuntu Security Notice USN-8217-1 April 28, 2026 node-follow-redirects vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in follow-redirects. Software Description: - node-follow-redirects: Node.js module that automatically follows HTTP(S) redirects Details: It was discovered that follow-redirects did not properly protect sensitive user information during redirects. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155) It was discovered that follow-redirects did not properly remove sensitive information before storage or transfer. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536) It was discovered that follow-redirects did not properly validate URLs when handling certain inputs. An attacker could possibly use this issue to redirect users to a malicious site, resulting in information disclosure or phishing attacks. (CVE-2023-26159) It was discovered that follow-redirects did not properly clear proxy authentication headers during cross-domain redirects. An attacker could possibly use this issue to cause exposure of sensitive credentials. (CVE-2024-28849) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS node-follow-redirects 1.14.9+~1.14.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS node-follow-redirects 1.2.4-1ubuntu0.20.04.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS node-follow-redirects 1.2.4-1ubuntu0.18.04.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8217-1 CVE-2022-0155, CVE-2022-0536, CVE-2023-26159, CVE-2024-28849
[USN-8216-1] .NET vulnerabilities
========================================================================== Ubuntu Security Notice USN-8216-1 April 28, 2026 dotnet10 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: Summary: Several security issues were fixed in .NET. Software Description: Details: Ludvig Pedersen discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-33116, CVE-2026-26171) Ludvig Pedersen and Kevin Jones discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. (CVE-2026-32203) Ludvig Pedersen discovered that the System.Net.Mail component in .NET incorrectly handled certain inputs. An attacker could possibly use this issue to perform a network spoofing attack. (CVE-2026-32178) It was discovered that the Microsoft.AspNetCore.DataProtection library in .NET did not properly verify cryptographic signatures under certain conditions. A remote attacker could possibly use this issue to elevate privileges. (CVE-2026-40372) Update instructions: The problem can be corrected by updating your system to the following package versions: After a standard system update, it is recommended to rotate the DataProtection key ring. References: https://ubuntu.com/security/notices/USN-8216-1 CVE-2026-26171, CVE-2026-32178, CVE-2026-32203, CVE-2026-33116, CVE-2026-40372
Tuesday, April 28, 2026
[USN-8219-1] UltraJSON vulnerabilities
========================================================================== Ubuntu Security Notice USN-8219-1 April 28, 2026 ujson vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in UltraJSON. Software Description: - ujson: Ultra fast JSON encoder and decoder Details: Cameron Criswell discovered that UltraJSON contained a memory leak that would occur when parsing large integers. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32874) It was discovered that UltraJSON contained integer overflow/underflow issues when calculating how much memory to reserve for indentation in certain instances. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of service. (CVE-2026-32875) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-ujson 5.11.0-3ubuntu0.1 Ubuntu 25.10 python3-ujson 5.10.0-1ubuntu0.1 Ubuntu 24.04 LTS python3-ujson 5.9.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS python3-ujson 5.1.0-1ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8219-1 CVE-2026-32874, CVE-2026-32875 Package Information: https://launchpad.net/ubuntu/+source/ujson/5.11.0-3ubuntu0.1 https://launchpad.net/ubuntu/+source/ujson/5.10.0-1ubuntu0.1
[USN-8185-2] Linux kernel (Low Latency NVIDIA) vulnerabilities
========================================================================== Ubuntu Security Notice USN-8185-2 April 28, 2026 linux-nvidia-lowlatency vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-nvidia-lowlatency: Linux low latency kernel for NVIDIA systems Details: Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Network block device driver; - Bluetooth drivers; - Character device driver; - TPM device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - GPU drivers; - Hardware monitoring drivers; - InfiniBand drivers; - Input Device core drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - Chrome hardware platform drivers; - x86 platform drivers; - Voltage and Current Regulator drivers; - SCSI subsystem; - SPI subsystem; - Media Oriented Systems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - USB Host Controller drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Watchdog drivers; - BFS file system; - BTRFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS+ file system; - File systems infrastructure; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - BPF subsystem; - Ethernet bridge; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - Memory management; - CAIF protocol; - Ceph Core library; - Networking core; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Rose network layer; - Network traffic control; - Network sockets; - Sun RPC protocol; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - STMicroelectronics SoC drivers; - USB sound devices; - KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS linux-image-6.8.0-1051-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-6.8.0-1051-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-6.8 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k-6.8 6.8.0-1051.54.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-8185-2 https://ubuntu.com/security/notices/USN-8185-1 CVE-2024-36347, CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209 Package Information: https://launchpad.net/ubuntu/+source/linux-nvidia-lowlatency/6.8.0-1051.54.1
[USN-8199-1] OpenStack Glance vulnerabilities
========================================================================== Ubuntu Security Notice USN-8199-1 April 22, 2026 glance vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in OpenStack Glance. Software Description: - glance: OpenStack Image Registry and Delivery Service Details: Martin Kaesberger discovered that OpenStack Glance's image processing could return the contents of arbitrary files. An attacker could possibly use this issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-32498) Hyeongeun Ji and Abhishek Kekane discovered several server-side request forgery vulnerabilities in OpenStack Glance's image import. An attacker could possibly use this issue to bypass URL validation checks and redirect to internal services. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-34881) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-api 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro glance-common 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro python3-glance 2:20.2.0-0ubuntu1.2+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-api 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-common 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro glance-registry 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro python-glance 2:16.0.1-0ubuntu1.1+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-api 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-common 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-glare 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro glance-registry 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro python-glance 2:12.0.0-0ubuntu2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8199-1 CVE-2024-32498, CVE-2026-34881