Skip to content
OpenAdvisories
Critical USN-8112-2 10 CVEs

linux-aws-fips, linux-fips, linux-gcp-fips vulnerabilities

Published Mar 20, 2026 · Updated Nov 3, 2026

Ecosystem: Ubuntu

Summary

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- MMC subsystem;
- Network drivers;
- USB Device Class drivers;
- BTRFS file system;
- HFS+ file system;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Simplified Mandatory Access Control Kernel framework;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56581, CVE-2024-56593,
CVE-2025-21704, CVE-2025-40215)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-aws-fips 4.15.0-2127.133
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-fips 4.15.0-1144.156
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-gcp-fips 4.15.0-2090.96

Vulnerabilities 10

  • Critical 9.1
    CVE-2024-47659

    smack: tcp: ipv4, fix incorrect labeling

    In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-56548

    hfsplus: don't query the device logical block size multiple times

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40215

    xfrm: delete x->tunnel as we delete x

    In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2024-56581

    btrfs: ref-verify: fix use-after-free after invalid ref action

    In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry'…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-56593

    wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-47599

    btrfs: use latest_dev in btrfs_show_devname

    In the Linux kernel, the following vulnerability has been resolved: btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reports the warning below: WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs] CPU: 2 …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48875

    wifi: mac80211: sdata can be NULL during AMPDU start

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-49267 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu Azure Linux
  • Unscored —
    CVE-2024-49927

    x86/ioapic: Handle allocation failures gracefully

    In the Linux kernel, the following vulnerability has been resolved: x86/ioapic: Handle allocation failures gracefully Breno observed panics when using failslab under certain conditions during runtime: can not alloc irq_pin_list (-1,0,20) Kernel panic - not sy…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-21704

    usb: cdc-acm: Check control transfer buffer size before access

    In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-47599
  • report
    https://ubuntu.com/security/CVE-2022-48875
  • report
    https://ubuntu.com/security/CVE-2022-49267
  • report
    https://ubuntu.com/security/CVE-2024-47659
  • report
    https://ubuntu.com/security/CVE-2024-49927
  • report
    https://ubuntu.com/security/CVE-2024-56548
  • report
    https://ubuntu.com/security/CVE-2024-56581
  • report
    https://ubuntu.com/security/CVE-2024-56593
  • report
    https://ubuntu.com/security/CVE-2025-21704
  • report
    https://ubuntu.com/security/CVE-2025-40215