USN-8961-1: Ubuntu updates kernel 5.15 with ABI change and mandatory reboot

Ubuntu published security notice USN-8961-1 on 3 November 2026, updating the Linux kernel for both 22.04 LTS and 20.04 LTS releases. Anyone managing servers or VPS on these two versions must schedule a reboot: this is not a routine update, as it involves an ABI change.

What the notice fixes

The bulletin explicitly documents a race condition in the AX.25 amateur radio protocol implemented in the Linux kernel, discovered by Duoming Zhou, leading to use-after-free vulnerabilities. In practical terms, a local attacker could exploit this issue to cause a denial of service (system crash). On its own the flaw is not critical: it requires local access and the impact remains a crash, not arbitrary code execution.

The actual number of fixes is considerably larger: the official advisory page lists CVE-2026-89847, CVE-2026-98342, CVE-2026-97450 and over 1065 others for this bulletin, distributed across dozens of subsystems (USB drivers, networking, filesystems, Bluetooth, ALSA, and others).

A 2022 bug resurfacing in 2026

CVE-2022-1205 is not a recent discovery. The original thread on oss-security shows the patch was accepted into mainline on 21 and 29 March 2022, with the CVE assigned on 1 April 2022. Four years later it reappears because Ubuntu is aligning it across all still-supported kernel 5.15 variants: the same identifier appears in parallel in advisories USN-8962-1 (linux-azure-fde) and USN-8963-1 (linux-nvidia-tegra), published in the same patch cycle.

What changes for server administrators

The affected releases are Ubuntu 22.04 LTS and 20.04 LTS, with dedicated packages for the major cloud kernels: AWS, Azure, Google Cloud, IBM, Oracle, plus KVM, GKE, realtime, FIPS and NVIDIA variants. For the 22.04 generic kernel, the final version is linux-image-5.15.0-202-generic 5.15.0-202.212.

Pay attention to the ABI change: anyone who has installed third-party kernel modules (proprietary drivers, hand-compiled modules) must recompile and reinstall them after the update. A standard upgrade with official metapackages (linux-generic and similar) handles this automatically; those who have removed those metapackages must do it manually before the reboot.