USN-8968-1: Ubuntu 14.04 patches 2021 Bluetooth flaw, Legacy add-on only

Canonical released USN-8968-1 on 3 November 2026, affecting Ubuntu 14.04 LTS (Trusty Tahr) exclusively. Anyone still running this version in production—usually due to application constraints that prevent upgrading—should know that the patch is no longer free: it requires an Ubuntu Pro subscription with the Legacy Support add-on.

The vulnerability

The advisory addresses CVE-2021-3640, a use-after-free vulnerability in the kernel's Bluetooth subsystem. The Linux kernel's Bluetooth subsystem contained a use-after-free flaw: a local attacker could exploit it to cause a denial of service (system crash) or potentially execute arbitrary code. The issue lies in the sco_sock_sendmsg() function: independent CVE database searches indicate the vulnerability stems from a race condition in the Bluetooth SCO implementation, where the conn object is freed with kfree() and another attacker-controlled thread can wait for this call to trigger the use-after-free condition. The CVSS 3.1 score is 7.0, High severity.

The advisory also mentions CVE-2022-49058, described generically as a set of fixes in the "file systems infrastructure" subsystem, with no further technical details in the published text.

Package and version

The fix arrives with the linux-image-3.13.0-219-generic update to version 3.13.0-219.270 (and related lowlatency, server and virtual packages). After the update, a machine reboot is required; anyone using third-party kernel modules must recompile them due to the ABI change.

Who can install it

Here's the operational catch: all package entries in the official table carry the note "Fix available with Ubuntu Pro via Legacy Support add-on". Without that subscription, the update is not available. Ubuntu 14.04 ended standard support in 2019 and Expanded Security Maintenance (ESM) in April 2024; since then it survives only thanks to the Legacy add-on, which according to Canonical's official blog extends Ubuntu 14.04 LTS coverage until April 2029—a total of 15 years from release. The cost of this add-on, again per Canonical, becomes available after the first 10 years of coverage and is priced 50% higher than standard Ubuntu Pro.

Anyone still managing Trusty servers in production should nonetheless plan for migration: it remains a 2014 codebase, and each new security patch arrives only on a paid basis.