USN-8960-1: Ubuntu patches over 150 kernel flaws in OEM 7.0 on 26.04 LTS

Canonical released the USN-8960-1 security advisory on 3 November 2026, concerning the linux-oem-7.0 package, the Linux kernel for OEM systems on Ubuntu 26.04 LTS. Anyone managing physical machines or VPS instances running on hardware with this specific kernel must plan the update and reboot shortly.

What the advisory addresses

The advisory describes multiple security issues discovered in the Linux kernel that an attacker could exploit to compromise the system. The list of affected subsystems is extensive: from file systems such as Btrfs, XFS, Ext4, NFS and OverlayFS, to network components (Netfilter, TCP, Bluetooth, WireGuard included in the Virtio group), spanning USB drivers, NVMe storage, memory management, KVM, io_uring and security modules such as AppArmor and SELinux. The list of resolved CVEs exceeds 150 entries, reflecting a substantial batch of patches cherry-picked from the upstream branch.

Corrected version and packages

The fix applies exclusively to Ubuntu 26.04 LTS in its OEM variant. The target versions are:

Package	Fixed version
linux-image-7.0.0-1017-oem	7.0.0-1017.17
linux-image-oem-26.04	7.0.0-1017.17
linux-image-oem-26.04a	7.0.0-1017.17
linux-image-oem-7.0	7.0.0-1017.17

The OEM kernel is a variant designed for specific hardware certified by manufacturers, distinct from the generic GA/HWE kernel of the same release based on Linux 7.0, released with Ubuntu 26.04 LTS "Resolute Raccoon" on 23 April 2026.

Attention to ABI change

Canonical notes that due to an unavoidable ABI change, kernel updates have received a new version number, which requires recompiling and reinstalling any third-party kernel modules that may be installed. Users who have not manually uninstalled standard metapackages (linux-generic, linux-virtual and similar) will see the operation handled automatically by the system update. Following patch installation, a reboot is still required to make the changes effective.

For administrators managing hosting resellers or VPS instances with the OEM kernel, the practical sequence remains: apt update && apt upgrade, verification of third-party modules (proprietary drivers, DKMS) and scheduled reboot during a maintenance window.