USN-8930-2: Ubuntu extends U-Boot patch to 26.10 after LTS release

Ubuntu published on 21 October 2026 advisory USN-8930-2, which addresses on Ubuntu 26.10 the same U-Boot vulnerabilities already resolved a week earlier on LTS releases. System administrators managing ARM virtual machine boots via QEMU or embedded boards based on i.MX will find here the missing update for the latest interim Ubuntu version.

What's different from USN-8930-1

The original advisory USN-8930-1, published on 14 October 2026, reported several security issues fixed in U-Boot on releases 26.04 LTS, 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS and 16.04 LTS. USN-8930-2 introduces no new flaws: it provides the corresponding U-Boot fix for Ubuntu 26.10, a release that was not included in the initial patch round.

Three vulnerabilities are addressed, identified by four CVE identifiers. U-Boot incorrectly handled certain NFS READ and NFS READLINK responses: an attacker could exploit this to trigger a buffer overflow, resulting in denial of service or arbitrary code execution (CVE-2026-74220, CVE-2026-74221). A second flaw concerns improper handling of certain failures in HTTP data storage within the lwIP implementation, which could lead to use-after-free and denial of service; this issue affected only Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The third flaw stems from failure to validate certain DHCPv6 option lengths during network boot, with risk of out-of-bounds memory access and denial of service, also limited to 24.04 LTS and 26.04 LTS (CVE-2026-74225).

Packages and versions for Ubuntu 26.10

For those running Ubuntu 26.10 "stonking", the packages requiring updates are u-boot-imx, u-boot-qemu and u-boot-tools, all bumped to version 2025.10-0ubuntu6. A standard system update applies the necessary changes; no additional manual procedures are noted in the advisory.

Who should care

U-Boot is not the bootloader for typical x86 hosting servers, but is widespread on ARM cloud instances and devices, i.MX boards and QEMU-based test environments. Anyone provisioning ARM instances or working on embedded infrastructure connected to self-hosted services should verify the installed version using dpkg -l | grep u-boot and proceed with the update.