USN-8965-1: Ubuntu patches NVIDIA BlueField DPU kernel

Ubuntu released security advisory USN-8965-1 on 3 November 2026, addressing ten vulnerabilities in the linux-bluefield kernel, the dedicated build for NVIDIA BlueField platforms. It affects only Ubuntu 20.04 LTS (Focal), and whilst a niche advisory, it warrants attention from those running BlueField cards in production: these DPUs (data processing units) offload networking, storage and security functions from the host CPU, typically found in mid-to-large data centres and private clouds. According to NVIDIA's official documentation, the supported operating system on BlueField DPUs is Ubuntu 20.04, hence the existence of a separately packaged kernel distinct from Ubuntu's generic kernel.\n\n## What the advisory addresses\n\nThe vulnerabilities span multiple subsystems: Ethernet bonding driver, network driver, SCSI subsystem, F2FS filesystem, NFS client, tracing infrastructure, io_uring subsystem, networking core, IUCV driver and RxRPC session socket. Of the ten CVEs listed, two warrant technical notes as they are better documented elsewhere.\n\nCVE-2026-52910 is a use-after-free in the kernel's BPF reuseport mechanism: according to Red Hat's advisory, when a cBPF program is detached from a reuseport group, it is freed immediately without waiting for RCU readers to complete, potentially leading to a use-after-free condition with memory corruption if another thread is simultaneously sending UDP packets to the reuseport group. The assigned CVSS score is 7.8 (high).\n\nCVE-2026-43456 concerns the bonding driver: when a non-Ethernet device, such as a GRE tunnel, is added to a bond, a type confusion vulnerability occurs because the bonding driver incorrectly copies network header operations from the slave device, risking kernel crash and denial of service.\n\n## How to update\n\n| Package | Corrected version |\n|---|---|\n| linux-image-5.4.0-1125-bluefield | 5.4.0-1125.132 |\n| linux-image-bluefield (Ubuntu Pro) | 5.4.0.1125.121 |\n| linux-image-bluefield-5.4 (Ubuntu Pro) | 5.4.0.1125.121 |\n\nThe update requires a system reboot. Watch out for ABI changes: the advisory notes that the version number change mandates recompilation and reinstallation of all third-party kernel modules, an operation normally handled automatically on a standard installation unless you have manually removed the standard metapackages (linux-generic and similar).