USN-8918-1: Azure kernel patch for Ubuntu 24.04, reboot and module rebuilds required

Ubuntu published security advisory USN-8918-1 on 13 October 2026, addressing a series of vulnerabilities in the linux-azure kernel for Ubuntu 24.04 LTS (noble). It affects users running virtual machines on Microsoft Azure with the standard, FDE (confidential VM) and FIPS variants of the Ubuntu kernel.

What's changing

The primary vulnerability cited in the advisory is CVE-2023-20585: certain AMD processors failed to properly enforce Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could have exploited this flaw to compromise the memory integrity of a SEV-SNP guest.

It's worth noting, to avoid overblown concern: Ubuntu's own CVE tracker classifies this vulnerability as low priority, since triggering the bug requires CAP_SYS_ADMIN to configure VFIO device passthrough and generate DMA operations that produce IOMMU events on affected hardware. In practice, you already need a compromised hypervisor and elevated privileges—this is not a remotely exploitable flaw for ordinary VM users.

Those using SEV-SNP on EPYC should nonetheless be aware that, according to AMD's security bulletin, mitigation requires both a SEV firmware update and a specific operating system update, and both must be applied.

Beyond this, the advisory groups dozens of additional minor fixes across virtually every kernel subsystem (storage, networking, filesystems, USB drivers, Bluetooth, cryptography, virtualisation).

Packages and versions

Package	Corrected version
linux-image-6.8.0-1069-azure-fde	6.8.0-1069.76
linux-image-6.8.0-1071-azure	6.8.0-1071.79
linux-image-6.8.0-1071-azure-fips	6.8.0-1071.79+fips1 (requires Ubuntu Pro)

Attention: reboot and module rebuilds

As with any kernel update, a machine reboot is required for changes to take effect. In this case the advisory flags an ABI change: anyone who has installed third-party kernel modules must recompile and reinstall them. If the standard metapackages (linux-generic, linux-virtual and the like) have not been manually removed, the system update handles this automatically.

Ten-year security coverage on Main and Universe, including access to FIPS builds, remains tied to Ubuntu Pro, which is free for up to five machines.