USN-8924-1: nine kernel flaws in Ubuntu 14.04, patches only with Ubuntu Pro

Canonical published USN-8924-1 on 13 October 2026, addressing nine vulnerabilities in the Linux kernel of Ubuntu 14.04 LTS "Trusty Tahr". Anyone still running production machines on this release—perhaps legacy VPS instances never migrated—should know that the patch does not arrive with a simple apt update: a paid subscription is required.

What the advisory fixes

Several security flaws have been corrected in the Linux kernel, according to the Ubuntu advisory. Among the issues resolved: the implementation of timer stats in the kernel allowed discovery of a real PID whilst inside a PID namespace, exposing sensitive information to a local attacker (CVE-2017-5967). Two flaws in the XFS and f2fs filesystems were also fixed, which allowed an attacker to construct a malicious image that, once mounted, caused a denial of service.

The most critical fixes concern use-after-free in epoll, the Bluetooth subsystem and Unix domain sockets: in all three cases a local attacker could, beyond causing a crash, achieve arbitrary code execution. The list closes with an NFS flaw that exposed kernel memory.

Patched version and how to apply it

Release	Package	Version
14.04 LTS trusty	linux-image-3.13.0-218-generic	3.13.0-218.269
14.04 LTS trusty	linux-image-3.13.0-218-lowlatency	3.13.0-218.269
14.04 LTS trusty	linux-image-generic	3.13.0.218.228

After upgrading, a system reboot is required to make all changes effective. The advisory also warns that due to an unavoidable ABI change, the kernel updates have received a new version number, which requires recompiling and reinstalling any third-party kernel modules that may be installed.

The crucial point: 14.04 has been out of standard support since 2019

Each package in the table bears the note "Fix available with Ubuntu Pro via Legacy Support add-on": without that subscription the patch is not available. Standard support for Trusty Tahr ended on 25 April 2019, five years after the April 2014 release. Canonical then extended coverage until 2029, bringing the total lifecycle to 15 years through the Legacy add-on announced in November 2025. Anyone still running production servers on this version without an Ubuntu Pro subscription should consider migrating to an LTS release still under standard support, such as 22.04 or 24.04.