USN-8923-1: two use-after-free flaws in Ubuntu 14.04 and 16.04 kernel

Canonical published USN-8923-1 on 13 October 2026, addressing two use-after-free flaws in the Linux kernel. The advisory covers only two releases now outside standard support: Ubuntu 16.04 LTS (Xenial) and Ubuntu 14.04 LTS (Trusty). Operators still running machines on these versions, typically for legacy application compatibility, need to know that the patch does not come free of charge.

What it fixes

The vulnerabilities affect two subsystems: SCSI and Bluetooth. CVE-2022-49114 is a use-after-free in the libfc module (fc_exch_abts_resp function), and CVE-2022-49111 is a use-after-free in the hci_send_acl function of the Bluetooth subsystem. According to the NVD record, CVE-2022-49114 is a high-severity vulnerability with a CVSS score of 8.8, and CVE-2022-49111 carries the same score of 8.8/10 on the CVSS scale.

Packages and versions

The affected packages are linux, linux-aws, linux-fips, linux-kvm and linux-lts-xenial.

Release	Package	Fixed version
16.04 LTS	linux-image-generic	4.4.0.289.295
16.04 LTS	linux-image-aws	4.4.0.1198.202
16.04 LTS	linux-image-kvm	4.4.0.1161.158
16.04 LTS	linux-image-fips	4.4.0.1130.132
14.04 LTS	linux-image-generic-lts-xenial	4.4.0.289.323~14.04.1
14.04 LTS	linux-image-aws	4.4.0.1160.157

Who can install it

All packages listed in the advisory are available only through the Ubuntu Pro Legacy Support add-on. Both releases have been outside standard support for some time: according to the official Ubuntu page, 16.04 LTS entered Legacy support in April 2026 and is covered until April 2031, whilst 14.04 LTS, with this extension, is now supported until April 2029, a 15-year span from its launch. The add-on is not included in the base Pro subscription: according to Canonical's blog, the Legacy add-on becomes available after the first 10 years of coverage, priced 50% higher than standard Ubuntu Pro.

After upgrading, a system reboot is required. The advisory notes an ABI change: operators with third-party kernel modules must recompile and reinstall them, an automatic process only if the standard metapackages (linux-generic, linux-virtual and similar) have not been manually removed.