USN-8966-1: Ubuntu patches two 2021 kernel vulnerabilities in 14.04 and 16.04

Ubuntu released security advisory USN-8966-1 on 3 November 2026, addressing two vulnerabilities in the Linux kernel for 16.04 LTS and 14.04 LTS. It affects organisations still running these systems in production under Extended Security Maintenance, typically legacy machines that have not yet migrated to more recent releases.

The two vulnerabilities

The first, CVE-2021-28714, affects the Xen backend network driver. Incoming data packets for a guest in the kernel's netback driver are buffered until the guest is ready to process them, and the timeout limiting accumulation is 60 seconds by default. An attacker inside a guest VM can exploit this to cause kernel memory exhaustion in the domain managing the network. This vulnerability is part of advisory Xen XSA-392, made public on 20 December 2021 alongside the related CVE-2021-28715. The CVSS 3.1 score assigned by the community is 6.5, medium severity.

The second, CVE-2021-3640, resides in the kernel's Bluetooth subsystem: a use-after-free condition that a local attacker can exploit to cause a system crash or, in some cases, execute arbitrary code. On the official Ubuntu Security page, this vulnerability is classified as High priority with a CVSS 3.1 score of 7.0.

Packages and versions

The update affects the linux, linux-aws, linux-fips, linux-kvm and linux-lts-xenial packages. On 16.04 LTS (xenial) it reaches, amongst others, linux-image-generic 4.4.0.290.296 and linux-image-fips 4.4.0.1131.133; on 14.04 LTS (trusty) linux-image-generic-lts-xenial 4.4.0.290.324~14.04.1 and linux-image-aws 4.4.0.1161.158.

What to do

After updating, a reboot is required to make the changes effective. The advisory also notes that the ABI change requires recompilation and reinstallation of any third-party kernel modules, unless the system uses standard metapackages (linux-generic and similar), in which case the operation happens automatically during the upgrade.

For most of the listed packages on both releases, the fix is available only through Ubuntu Pro with the Legacy Support add-on; the exception is the FIPS Updates line, covered by standard Ubuntu Pro subscription.