Ubuntu kernel USN-8875-1 updates and vulnerabilities: PHP 8.6 due 19 November

Canonical released security advisory USN-8875-1 on 6 October 2026, addressing vulnerabilities in the Linux kernel for Ubuntu 20.04 LTS and 22.04 LTS. We're covering it because it continues to generate searches from those managing VPS and cloud servers on these two LTS releases, and it's one of those cases where a faulty update can cost downtime.

What the advisory says

According to the official advisory, several security issues were fixed in the Linux kernel, with releases for Ubuntu 22.04 LTS and 20.04 LTS. Among the patched flaws is a null pointer dereference vulnerability in the i.MX clock driver, which a local attacker could exploit to cause a denial of service through system crash (CVE-2022-3114). The advisory also covers a lengthy list of kernel subsystems, from ARM and x86 architectures to networking, BTRFS, XFS, and NFS filesystems, and numerous drivers.

The packages involved are those listed: linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp. Those managing instances on AWS, Azure, GKE or IBM Cloud should check their specific variant, not just the generic kernel.

The same patch cycle produced two related advisories with separate packages: USN-8875-2, released on 9 October 2026, concerns the linux-nvidia variant for 22.04 LTS, resolved with linux-image-5.15.0-1112-nvidia packages version 5.15.0-1112.113. USN-8878-1, released on 6 October 2026, concerns linux-gcp-5.15 for 20.04 LTS, version 5.15.0-1118.128~20.04.1, and adds a flaw not present in the main advisory: some ARM processors could complete a TLB broadcast invalidation before memory writes became globally observable, allowing a local attacker to write to memory after permission revocation (CVE-2025-10263).

How to verify and update

First, check the running kernel version:

uname -r

Then update:

sudo apt update && sudo apt full-upgrade

After installation, run uname -r again: if the version number hasn't changed, the new kernel isn't active yet. According to the official advisory, after a standard system update you must reboot the machine for all changes to take effect, and the ABI change requires recompiling and reinstalling any third-party kernel modules—an operation the standard metapackage upgrade performs automatically.

On production servers where immediate reboot isn't feasible, the alternative is Livepatch: according to Canonical's documentation, the service applies critical kernel security patches without rebooting the system. It remains a workaround nonetheless: Canonical itself clarifies that Livepatch does not replace system update and reboot. To enable it: sudo pro enable livepatch, verify with canonical-livepatch status --verbose.

PHP 8.6 countdown

19 November 2026 is also the date set for the general release of PHP 8.6: according to the official php.net website, the next release will be the first GA, PHP 8.6.0, scheduled for 19 November 2026. RC4 was released on 5 November. For what's new in the version—including the new polling API and deprecations to check before upgrading—we refer you to the guide already published on UptimeMag.