+61 2 9043 1246

Knowledge base

USN-8903-1: the Ubuntu Linux kernel security update, explained for website owners

Published · By , Co-Founder, BLACKBX

USN-8903-1 is Canonical’s 8 October 2026 kernel update for Ubuntu 24.04 and 22.04 servers. It fixes 232 flaws, and one of them, CVE-2026-53266, is on CISA’s list of vulnerabilities being exploited. If your website runs on one of these servers, have the kernel updated and confirm it is running.

Key fact USN-8903-1
What A bundle of 232 Linux kernel fixes for Ubuntu. One, CVE-2026-53266, is a memory flaw in the bridge firewall’s ebtables SNAT feature (CWE-825 per Red Hat; CISA calls it an out-of-bounds write).
Affected Ubuntu 24.04 LTS kernels linux, linux-aws, linux-aws-fips, linux-fips and linux-realtime; on 22.04 LTS only the 6.8-based linux-aws-6.8 and linux-realtime-6.8. Azure, Google Cloud and IBM kernels have their own notices. Ubuntu 26.04 is not covered. The standard 22.04 kernel (5.15) is not listed, and that does not mean it is safe.
Fixed in USN-8903-1, published 8 October 2026, for example 6.8.0-146.146 (24.04 linux, per our scanner) and 6.8.0-1066.69~22.04.1 (22.04 AWS). The latest kernel version available today is not known.
Severity No overall score from Canonical; our scanner rates the notice High. CVE-2026-53266 is 8.8 High from Canonical and the Linux kernel CNA, 7.5 from Red Hat and Oracle, 6.8 from SUSE and 5.3 from Amazon. No NVD score found.
Needs a login? Disputed for CVE-2026-53266: Canonical and the kernel CNA say a low-privilege local account; SUSE and Amazon say no login, from the local network.
Exploited? Yes. CISA added CVE-2026-53266 to its Known Exploited Vulnerabilities list on 18 September 2026 on evidence of active exploitation, and public exploits are reported. Who is attacking and how widely is not known.
Do now Ask whoever manages your server to install the USN-8903-1 kernel and confirm the server is actually running it.

Facts checked on 9 October 2026 against Canonical’s notice and CVE pages, CISA, Red Hat, SUSE, Oracle Linux, Amazon Linux, Qualys, TuxCare and CloudLinux. Sources are listed at the end.

What is USN-8903-1?

USN-8903-1 is a security notice from Canonical, the company that makes Ubuntu. Ubuntu is a version of Linux, the operating system that a great many web servers run on. A USN, or Ubuntu Security Notice, is how Canonical announces that it has released fixes. This one, titled “Linux kernel vulnerabilities”, was published on 8 October 2026 and covers the kernel as packaged for Ubuntu 24.04 LTS and 22.04 LTS. LTS stands for long-term support: these are the releases most servers run.

The kernel is the core of the operating system. It sits between programs and the hardware, and it runs networking, files, memory and devices. Your website, its database and everything else on the server sit on top of it.

This notice is not one bug. Ubuntu’s notice index lists “CVE-2026-63949, CVE-2026-63957, CVE-2026-64014 + 229 others”, which makes 232 separate flaws. A CVE is the public reference number given to a single security flaw. Canonical’s summary is short: “Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.” The fixes reach into many parts of the kernel, including Netfilter (the built-in firewall), IPv4 and IPv6 networking, the Ext4 file system, FUSE, SMB, Bluetooth, USB and graphics drivers, and memory management.

One of those 232 matters more than the rest: CVE-2026-53266. It is the reason our scanner marks this notice as being on CISA’s list of exploited vulnerabilities. That list names individual CVEs, not Ubuntu notices, so the notice itself has no entry of its own.

In plain terms, CVE-2026-53266 is a flaw in a feature called “ebtables SNAT”, part of the kernel’s bridge firewall. A bridge is a software connection that joins network interfaces together, and the bridge firewall filters traffic crossing it. Red Hat says the flaw can let a local attacker corrupt memory, crash the system or possibly gain higher privileges, meaning more control over the server than they should have. Sources describe the type of flaw differently. CISA calls it an “Out-of-Bounds Write”, where the kernel writes outside the memory it is meant to use. Red Hat lists it as CWE-825, “Expired Pointer Dereference”, where the kernel uses memory it should already have let go of. Either way, the result is the kernel’s memory being damaged.

Our scanner’s CVE list for USN-8903-1 includes CVE-2026-53266. The copy of Canonical’s page we could read was cut off before its list of CVEs ended, so we have not seen that line on Canonical’s page ourselves. Canonical’s own page for the CVE, last updated on 29 September 2026, still showed 22.04 and 24.04 as “Vulnerable, work in progress” at that point.

Who reported the flaws is not known, either for the notice or for CVE-2026-53266. CVE-2026-53266 was published on 25 June 2026.

Which versions are fixed, and which are not

For USN-8903-1 to apply to your website, all of these must be true:

  1. Your website runs on a server using Ubuntu 24.04 LTS or Ubuntu 22.04 LTS.
  2. That server uses one of the kernel packages the notice covers. On 24.04 these are linux, linux-aws, linux-aws-fips, linux-fips and linux-realtime, plus linux-aws-6.8 and linux-realtime-6.8. On 22.04, only the 6.8-based kernels are covered: linux-aws-6.8 and linux-realtime-6.8.
  3. The kernel has not yet been updated to the fixed versions released on 8 October 2026.

The fixed versions we saw on Canonical’s page include:

  • linux-image-6.8.0-146-fips: 6.8.0-146.146+fips1
  • linux-image-kvm: 6.8.0-146.146
  • linux-image-aws and linux-image-aws-6.8 on 22.04: 6.8.0-1066.69~22.04.1

Our scanner’s data lists these as well, which we could not see on Canonical’s page ourselves: 6.8.0-146.146 for the standard 24.04 linux kernel, 6.8.0-1066.69 for linux-aws, 6.8.0-1066.69+fips1 for linux-aws-fips, 6.8.1-1061.62 for linux-realtime, and 6.8.1-1061.62~22.04.1 for linux-realtime-6.8 on 22.04. The latest kernel version available today is not known.

What this notice does not cover:

  • Azure, Google Cloud and IBM kernels. These have their own notices, published the same day: USN-8904-1 for Azure, USN-8905-1 for Google Cloud and USN-8906-1 for IBM. If your server is on one of those platforms, the relevant notice is that one, not this one.
  • Ubuntu 26.04 LTS. For CVE-2026-53266, Canonical shows 26.04 as fixed in 7.0.0-31.31, which arrived in USN-8726-3 on 21 September 2026.
  • The standard Ubuntu 22.04 kernel, version 5.15. It is not in this notice’s package list. The notice says nothing either way about whether it is affected, and we have not established whether it gets these fixes elsewhere. Do not read its absence as a clean bill of health. CloudLinux, a vendor that ships its own kernels, says CVE-2026-53266 is present in its 5.15 kernel for Ubuntu 22.04 but “out of reach by default”.
  • Older releases, for CVE-2026-53266 specifically. Canonical lists Ubuntu 20.04 LTS as “Vulnerable”. It lists 18.04, 16.04 and 14.04 as “Not affected”.

Not every one of the 232 flaws affects both releases. Canonical lists CVE-2026-92502, for example, as “Not affected” on 22.04 but vulnerable on 24.04. How many servers run the affected kernels is not known.

If your site runs on an Ubuntu 22.04 or 24.04 server and nobody has updated its kernel since 8 October 2026, assume you are in scope until someone checks the version.

Why this matters for a website owner

The worst case is the one Canonical states in its own summary: an attacker could possibly use these flaws to compromise the system. The system here is the server your website runs on, not just the website.

Most website problems sit inside the website: a plugin, a theme, a form. A kernel flaw sits underneath all of that. If an attacker gains higher privileges on the server, the website, its database and anything else stored there are within their reach. Three things make CVE-2026-53266 worth acting on now:

  • It is already being exploited. CISA, the United States cyber security agency, added it to its list of known exploited vulnerabilities on 18 September 2026. That is not a prediction. It is a record of attacks that have happened.
  • Nobody agrees on whether a login is needed. Canonical and the Linux kernel CNA (the official body that issues CVEs for the kernel) say the attacker needs a low-privilege account on the server, with no user interaction needed. Red Hat also describes a “local attacker”. But SUSE and Amazon score it as reachable from the local network without any account, Red Hat’s and Oracle’s scores use a network attack route, and SecurityWeek says it can be triggered “with a crafted packet”.
  • It sits under everything. The kernel runs the server’s networking, memory and files. A flaw at that level is not confined to one website or one user account.

There are real limits, and they are worth knowing. Red Hat says the flaw only matters if the server has specific bridge firewall rules configured. CloudLinux says an ordinary account can only reach it where “private network spaces are open”. Many web servers will not have that setup. Whether yours does is something to check, not something to assume.

On scoring: the notice as a whole has no overall score from Canonical. The “High” rating is from our scanner. For CVE-2026-53266 itself, CVSS (a 0 to 10 severity scale) scores vary by organisation:

  • Canonical: 8.8, High, with Ubuntu priority “High”
  • Linux kernel CNA: 8.8
  • Red Hat: 7.5
  • Oracle: 7.5
  • SUSE: 6.8
  • Amazon Linux: 5.3

The gap comes from different assumptions. The 8.8 scores assume an attacker with a low-privilege account on the server, and that the damage can spread beyond the part of the system first attacked. SUSE and Amazon assume an attacker on the same local network with no account, but rate the attack as harder to pull off; Amazon also rates the harm lower. We found no score from NVD, the US government’s vulnerability database. SecurityWeek and Security Affairs both report 8.8.

The other 231 flaws in the notice have not been assessed one by one here.

Which of the CVEs is being exploited?

CVE-2026-53266. CISA added it to its Known Exploited Vulnerabilities list, often called KEV, on 18 September 2026, “based on evidence of active exploitation”. KEV is CISA’s public list of flaws it knows attackers are using. US federal agencies had until 21 September 2026 to fix it, under CISA directive BOD 26-04.

On public exploit code, meaning attack tools anyone can download:

  • Qualys says Red Hat’s advisories acknowledge active exploitation and report that public exploits are known.
  • TuxCare says public exploit code exists for “two of the three” kernel CVEs added to KEV at that time, without saying which two.

What is not known: who is exploiting it, since when, and how widely. TuxCare says neither CISA nor Red Hat has published an attack chain, targets or telemetry, and that use by ransomware groups is listed as unknown.

One small inconsistency: CISA’s alert is titled “Two” and names CVE-2025-39964 and CVE-2026-53266, while the press reports three kernel flaws added that day. This does not change CVE-2026-53266’s status. Two other kernel flaws put on KEV in September 2026, CVE-2025-39682 and CVE-2025-39964, are not in this notice’s CVE list according to our scanner. We found none of the other 231 CVEs in USN-8903-1 on KEV.

For an Australian business, the US federal deadline does not apply. What the KEV listing does tell you is that this has moved from theory to practice. Ubuntu’s fix for 22.04 and 24.04 arrived 20 days after the KEV listing. For a website on one of those servers, the deadline that matters is today.

What should you do now?

In this order:

  1. Find out what your server runs. You need three things: the Ubuntu release (22.04, 24.04 or something else), the kernel package, and the kernel version currently running. If you are on shared hosting, your host will know. If your website is on its own server or cloud account, ask whoever set it up or manages it. Ask them directly whether USN-8903-1 applies, or USN-8904-1, USN-8905-1 or USN-8906-1 if the server is on Azure, Google Cloud or IBM.
  2. Update the kernel. Install the updated kernel packages for your Ubuntu release. Canonical’s notice has an “Update instructions” section for each package. Our scanner’s advice is to update the kernel package and reboot; we could not confirm that wording on Canonical’s page. Either way, ask whoever does the update to confirm the server is actually running the fixed version afterwards, not just that it was installed.
  3. If the update cannot happen today, ask about the workaround. For CVE-2026-53266 only, Red Hat describes a temporary workaround involving the server’s ebtables SNAT bridge firewall rules. It is a job for whoever manages the server, and it covers one flaw, not the other 231.
  4. Check for signs of compromise. No vendor or researcher has published indicators of compromise for this flaw, so there is no checklist to work from. Ask whoever manages the server whether anything unusual has been seen since late June.
  5. If you think the server was compromised, treat it as a problem with the whole server, not just the website. No vendor has published specific steps beyond updating, and an update stops new attacks; it does not remove anything already there. Get whoever manages the server involved before changing anything.
  6. Record what you did. Write down the date, the kernel version before and after, and who did it. If anything goes wrong later, that record is the first thing anyone will ask for.
  7. Reduce exposure. If the server is on Ubuntu 20.04, Canonical lists it as vulnerable to CVE-2026-53266 and this notice does not cover it, so ask what the plan is for that server. If you are on the standard 22.04 kernel (5.15), ask how it is being kept up to date, because this notice does not answer that.

If step one is already beyond what you can find out about your own website, that is the problem this blog exists to talk about. Skip to the bottom.

Why updating is not the whole fix

CVE-2026-53266 was published on 25 June 2026. Oracle Linux shipped its first fixes on 14 July. CISA listed it as exploited on 18 September. Ubuntu 26.04 was fixed on 21 September. The fix for Ubuntu 22.04 and 24.04 in this notice arrived on 8 October 2026, 15 weeks after the flaw was published and 20 days after it was confirmed as exploited.

The update stops new attacks. It does nothing about those weeks in which the server may have been attacked, nor about anything an attacker changed or left behind in that window. And because no one has published signs of compromise for this flaw, there is no simple test that tells you the server is clean.

There is also the question of whether the update is really in place. A kernel update that has been downloaded but is not yet running leaves the server exactly where it was. Our scanner’s advice includes a reboot for that reason, and whoever does the work should confirm the running version afterwards.

Then there is the question of who is actually watching the site. The host looks after the server, the agency that built the site has moved on, and the plugin updates belong to no one. A kernel notice sits right on the line between those jobs. On shared hosting, the kernel is usually the host’s responsibility. On a website’s own cloud server, it belongs to whoever is looking after that server, and many owners do not know who that is until they need to ask.

That is the pattern with most serious server vulnerabilities. The fix arrives quietly, the attacks may already be under way, and the gap between the two is filled by whoever is actually watching.

What this looks like with BLACKBX

BLACKBX scans every site it looks after daily against published security advisories, including notices like USN-8903-1. When a client’s site matches a critical advisory, our developers patch it immediately; lower-severity items are done at the next service. Every update is dated and recorded in the client’s logbook, so there is always an answer to “when was this fixed, and to what version?”

On the Monitor plan, the finding goes to the client’s own developer with the version numbers and advice, so they can do the work. On Maintenance and Full service, BLACKBX does the work. All plans are monthly, with no minimum term.

Timeline

Date Event
25 June 2026 CVE-2026-53266 published
14 July 2026 First Oracle Linux fixes for CVE-2026-53266
18 September 2026 CISA adds CVE-2026-53266 to its Known Exploited Vulnerabilities list
19 September 2026 The Hacker News reports the KEV listing
21 September 2026 US federal deadline under BOD 26-04; SC World reports it; Ubuntu 26.04 fix released in USN-8726-3
23 September 2026 Qualys publishes its BOD 26-04 timelines
29 September 2026 Canonical’s CVE-2026-53266 page still shows Ubuntu 22.04 and 24.04 as vulnerable
8 October 2026 Canonical publishes USN-8903-1, along with USN-8904-1, USN-8905-1 and USN-8906-1
9 October 2026 This article published

Sources

Common questions

What is USN-8903-1?

USN-8903-1 is a security notice Canonical published on 8 October 2026 for the Linux kernel on Ubuntu 24.04 LTS and 22.04 LTS. It fixes 232 separate flaws, one of which, CVE-2026-53266, is on CISA’s list of vulnerabilities being exploited. BLACKBX scans every site it looks after daily against notices like this one and records each update in the client’s logbook.

Is my website affected by USN-8903-1?

Your website is in scope for USN-8903-1 if it runs on an Ubuntu 24.04 server, or an Ubuntu 22.04 server with a 6.8-based kernel such as linux-aws-6.8 or linux-realtime-6.8, and the kernel has not been updated since 8 October 2026. Azure, Google Cloud and IBM kernels have their own notices. If you do not know what your server runs, BLACKBX can tell you whether this notice applies.

Is CVE-2026-53266 being exploited?

Yes. CISA added CVE-2026-53266 to its Known Exploited Vulnerabilities list on 18 September 2026 based on evidence of active exploitation, and public exploits are reported. Who is attacking and how widely is not known. Its fix for Ubuntu 22.04 and 24.04 is tied to USN-8903-1 in our scanner’s data. When a BLACKBX client’s site matches a critical advisory like this, our developers patch it immediately.

Do I need to reboot after the USN-8903-1 kernel update?

Our scanner’s advice for USN-8903-1 is to update the kernel package and reboot, though we could not confirm that exact wording on Canonical’s page. Whoever does the update should confirm the server is running the fixed kernel version afterwards. On Maintenance and Full service plans, BLACKBX does that work and records the version in the client’s logbook.

Is the standard Ubuntu 22.04 kernel (5.15) affected by USN-8903-1?

USN-8903-1 does not list the standard Ubuntu 22.04 kernel, version 5.15, and says nothing either way about whether it is affected. That is not the same as being safe. CloudLinux says CVE-2026-53266 is present in its own 5.15 kernel for 22.04 but out of reach by default. BLACKBX can check which kernel your server runs and what applies to it.

How does BLACKBX handle a notice like USN-8903-1?

BLACKBX scans every site it looks after daily against published advisories such as USN-8903-1. Critical matches are patched immediately; lower-severity items are done at the next service, and every update is dated in the client’s logbook. On the Monitor plan the finding goes to the client’s own developer with version numbers and advice; on Maintenance and Full service, BLACKBX does the work.

Is this your site?

Does USN-8903-1 apply to the server your website runs on?

Tell us your website’s address and we will tell you whether USN-8903-1 applies to it. If it does, we will fix it and record the work in your logbook.

Ask us if this applies to you Get these alerts by email

Or call +61 2 9043 1246. Monthly plans, no minimum term.