USN-8962-1: Ubuntu fixes over 300 CVEs in Azure confidential VM kernel

Canonical released security advisory USN-8962-1 on 3 November 2026, covering the linux-azure-fde package, the Linux kernel for Microsoft Azure CVM cloud systems, limited to Ubuntu 22.04 LTS (jammy). Anyone managing confidential VMs on Azure with this distribution needs to plan for the update.

What it fixes

Among the listed vulnerabilities, one stands out as not recent: Duoming Zhou discovered race conditions in the Linux kernel's implementation of the AX.25 amateur radio protocol, leading to use-after-free vulnerabilities; a local attacker could exploit them to cause a denial of service (system crash), identified as CVE-2022-1205. The rest of the bulletin is a cumulative update: several security issues were discovered in the Linux kernel that an attacker could use to compromise the system, with fixes spanning dozens of subsystems, from USB and Bluetooth drivers to Btrfs, Ext4, XFS and NFS filesystems, plus IPv4/IPv6 networking stacks, Netfilter and Bluetooth. Counting the references published in the bulletin, the CVEs involved exceed 300.

Why this affects CVMs specifically

The package is not the generic Azure kernel but the one dedicated to confidential VMs, designed for regulated workloads. According to Ubuntu's official documentation on Azure, memory is always encrypted via the TEE in a confidential VM, while full disk encryption (FDE) is optional and requires explicit activation after VM provisioning. When active, Ubuntu encrypts and decrypts all disk data with AES and validates every step of the boot process via UEFI Secure Boot, with the disk encryption key stored in encrypted form on the virtual disk itself, tied to the instance's vTPM.

Update instructions

The patched versions are: linux-image-5.15.0-1124-azure-fde – 5.15.0-1124.133, linux-image-azure-fde-5.15 – 5.15.0.1124.133, linux-image-azure-fde-lts-22.04 – 5.15.0.1124.133. Canonical notes that the ABI change requires recompiling and reinstalling any third-party kernel modules, which happens automatically with a standard update unless the standard metapackages (linux-generic and similar) have been manually removed. A system reboot is required after the update.