Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- Open vSwitch;
- SCTP protocol;
(CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-64531)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws-6.8 | 6.8.0-1063.66~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure-fde-6.8 | 6.8.0-1064.71~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-azure-fde | 6.8.0-1064.71 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-nvidia-tegra | 6.8.0-1032.34 |
| Ubuntu · Pro FIPS-updates 24.04 LTS Pro:FIPS-updates:24.04:LTS | linux-azure-fips | 6.8.0-1065.73+fips1 |
Vulnerabilities 4
-
Critical 9.8
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is pars…
-
Critical 9.8
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace…
-
Critical 9.1
sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…
-
High 7.8CVE-2026-64531 Public exploit
net: openvswitch: reject oversized nested action attrs
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbeh…