USN-8967-1: Ubuntu patches kernel DoS on AWS 16.04, reboot required

Canonical published USN-8967-1 advisory on 3 November 2026, addressing a denial-of-service vulnerability in the linux-aws kernel for Ubuntu 16.04 LTS. It affects those running EC2 instances with xenial and the AWS-optimised kernel: if that's your case, a reboot is mandatory.\n\n## The issue\n\nThe bug was discovered by Jürgen Groß and concerns the Xen network backend driver in the Linux kernel. The driver failed to properly limit the number of packets queued when a guest VM was not processing them. An attacker within a guest VM can exploit this to cause a denial-of-service attack by exhausting kernel memory in the domain managing the network, that is, in the host running the VMs, not the VM itself.\n\nThe vulnerability is tracked as CVE-2021-28714 and has been known for some time: it is part of the Xen advisory XSA-392, which explained that the timeout after which a stalled client is considered blocked is rather lengthy—60 seconds by default—and a UDP connection on a high-speed interface can easily accumulate gigabytes of data in that timeframe. In a multi-tenant environment, this means that a single "noisy" tenant can put strain on the shared host.\n\n## Packages and versions\n\nThe advisory affects only Ubuntu 16.04 LTS (xenial) and the linux-aws package. The corrected version is linux-image-4.4.0-1199-aws at 4.4.0-1199.214, with the linux-image-aws metapackage updated to 4.4.0.1199.203. Both are available only through Ubuntu Pro's Legacy Support add-on, since 16.04 has been out of standard support for years.\n\nThe same fix, on the same day, was also released for the generic, fips, kvm and lts-xenial kernels on 16.04 and 14.04 via the related USN-8966-1 advisory, along with a second Bluetooth vulnerability (CVE-2021-3640) not present in the AWS variant.\n\n## What to do\n\nAfter a standard system update, a reboot is required to make the changes effective. Canonical notes that the update involves an ABI change: anyone running third-party kernel modules must recompile and reinstall them—an automatic operation if the standard metapackages (linux-generic, linux-virtual and similar) have not been manually uninstalled.\n\nThose still managing AWS instances with Ubuntu 16.04 should verify their Ubuntu Pro subscription, which is necessary to receive the patch, and plan a maintenance window for the reboot.