USN-8917-1: the Ubuntu Linux kernel security update, explained for website owners

Facts checked on 14 October 2026 against Ubuntu’s notices USN-8917-1, USN-8918-1, USN-8911-1 and USN-8903-1, CISA, Qualys, The Hacker News, Security Affairs and UbuntuUpdates.org. Sources are listed at the end.

What is USN-8917-1?

USN-8917-1 is a security notice from Canonical, the company behind Ubuntu, published on 13 October 2026. A USN (Ubuntu Security Notice) is Ubuntu’s announcement of one update. For the kernel, one update usually fixes many separate vulnerabilities at once. This one covers the Linux kernel on Ubuntu 24.04 LTS, the long-term support release code-named “noble”.

The kernel is the core of the operating system. It is the layer between the server’s hardware and every program on it, including the web server, PHP and the database that together run your website. If your website lives on an Ubuntu 24.04 server, this kernel is underneath it.

Ubuntu’s own summary is short: “Several security issues were fixed in the Linux kernel.” It adds: “An attacker could possibly use these to compromise the system.”

The advisory feed we scan against lists about 1,050 separate CVEs in this notice. A CVE is the public ID number given to one vulnerability. We have not counted them against Ubuntu’s page ourselves, so treat that number as approximate. The fixes reach across a long list of kernel areas, including Bluetooth, graphics (GPU), Hyper-V, InfiniBand, input devices, SCSI and SPI drivers, the TPM driver, the hardware crypto drivers, the GPIO subsystem, RBD and DRBD block devices, the Amazon Nitro Secure Module driver and several others.

The only flaw Ubuntu describes on its own is CVE-2023-20585. Some AMD processors did not properly check memory permissions in one situation. Someone with control of the hypervisor (the software layer that runs virtual machines, normally operated by the hosting provider) could possibly use this to tamper with protected virtual-machine memory.

In plain terms, this is a large kernel update that closes a great many holes in the foundation your website stands on, and it does nothing until the server is restarted.

There is no single reporter, because the notice bundles many independent issues. One CVE in the list is worth naming. CVE-2026-68121 was called “PPPoEject” by The Hacker News on 19 September 2026, which reported it as one of four local privilege-escalation flaws disclosed by researcher Asim Manizada. A privilege escalation lets someone who already has a small foothold on a server give themselves full control of it. Its place in this notice comes from our advisory feed’s list; we have not confirmed it on Ubuntu’s own page for that CVE.

Who is affected?

Your server is in scope if all of these are true:

1. Your website runs on a server, or a virtual server, using Ubuntu 24.04 LTS.
2. That server uses one of the kernels this notice covers: the standard generic kernel, lowlatency, fips, the cloud kernels for AWS, Google Cloud (gcp, gke and gkeop), IBM and Oracle, or the real-time kernel.
3. The kernel actually running on it is older than the fixed version for its flavour, listed in the next section.

The third point matters. A server can have the new kernel installed and still be running the old one, because the change only takes effect after a reboot.

What this notice does not cover:

• The Azure kernel. Servers on Microsoft Azure’s kernel are covered by a separate notice, USN-8918-1, which lists USN-8917-1 as related.
• OEM kernels. These are covered by USN-8911-1, published on 9 October 2026.
• Ubuntu 22.04. Servers on 22.04 running 6.8 kernels received fixes in other notices, such as USN-8903-1 on 8 October 2026. We explained that one in our post on USN-8903-1.
• Other Ubuntu releases. Releases such as 20.04 are not listed on USN-8917-1. Whether they are affected by the same flaws was not established.

How many servers run Ubuntu 24.04 with these kernels is not known.

If you are on shared or managed hosting, the hosting company controls the kernel. You cannot update it yourself, but you can ask whether this update has been applied and the server rebooted.

If your site runs on an Ubuntu 24.04 server and nobody has confirmed a kernel update and a reboot since 13 October 2026, assume you are in scope until someone checks the version.

Which versions are fixed, and which are not

All of these fixes were published on 13 October 2026 for Ubuntu 24.04 LTS. Any kernel older than the version shown for its flavour is not fixed.

• generic and generic-64k: 6.8.0-147.147
• fips: 6.8.0-147.147+fips1
• lowlatency and lowlatency-64k: 6.8.0-147.147.1
• aws and aws-64k: 6.8.0-1067.70
• aws-fips: 6.8.0-1067.70+fips1
• gcp and gcp-64k: 6.8.0-1071.79
• gcp-fips: 6.8.0-1071.79+fips1
• gke and gke-64k: 6.8.0-1066.74
• gkeop: 6.8.0-1052.56
• ibm: 6.8.0-1067.68
• oracle and oracle-64k: 6.8.0-1064.67
• realtime: 6.8.1-1062.63, available only with Ubuntu Pro, Canonical’s paid support subscription

The FIPS packages are labelled by Ubuntu as “FIPS Updates FIPS-140 certified package”. FIPS kernels are used where a certified cryptography setup is required, usually by government and regulated organisations.

Whether a newer kernel has been released since 13 October 2026 is not known. If your server shows a higher number than the one above for its flavour, it already includes these fixes.

One small uncertainty. A third-party package tracker, UbuntuUpdates.org, appeared to show 6.8.0-147.147 in Ubuntu’s update channel on a page dated before the notice. That may mean the package was available a little earlier than 13 October. We have not verified it, and it does not change what you need to do.

Why this matters for a website owner

If one of these flaws is used against your server, the attacker could take control of the machine your website runs on, and everything on it: the site, the database, customer details and email that passes through it. Ubuntu’s words are that an attacker “could possibly use these to compromise the system”.

Three things shape how worried to be:

• The flaws we know about need a foothold first. The two flaws described individually are local. CVE-2023-20585 needs someone who already controls the hypervisor, which is normally the hosting provider’s level. CVE-2026-68121 is a local privilege escalation, which means the attacker must already be able to run code on the server. For the other thousand or so CVEs, Ubuntu does not say whether a login or local access is needed.
• A website can be the foothold. A flaw in a website plugin or theme that lets someone run code on the server gives them exactly the local access these kernel flaws need. On its own, a hacked website is bad. Combined with an unpatched kernel, it can become a lost server.
• Installing is not the same as fixing. The kernel update is only in effect after the server reboots. Servers that install updates automatically but are never restarted keep running the old, flawed kernel.

There is no single severity score for this notice. Severity scores for individual flaws use CVSS (the Common Vulnerability Scoring System), which rates a flaw from 0 to 10. Ubuntu does not put one CVSS score on a bundled kernel notice, and each CVE inside it has its own score, which we were not able to retrieve. The advisory feed our daily scan reads rates USN-8917-1 as HIGH. We could not establish who assigned that rating, so read it as a sign of priority, not as an official score.

Is it being exploited?

Not known. We found no report of in-the-wild exploitation for USN-8917-1 or for any CVE we could confirm is in it. We also found no press coverage of this notice.

The question of the CISA KEV list needs care. CISA is the US government’s cyber security agency, and its Known Exploited Vulnerabilities (KEV) catalogue lists flaws it has evidence are being used in real attacks. Our advisory feed marks this notice as containing a KEV-listed flaw. We tried to confirm that and could not:

• CISA added Linux kernel flaw CVE-2026-31431 to KEV on 1 May 2026.
• CISA added Linux kernel flaws CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 to KEV on 18 September 2026, as reported by Qualys and Security Affairs.
• None of those four is in our feed’s list of CVEs for USN-8917-1. We checked them by hand.

We could not compare all of the roughly 1,050 CVEs against the full catalogue, so we cannot say whether this notice contains a KEV-listed flaw or not. The honest answer is that it is unresolved.

On proof-of-concept code, meaning published code that demonstrates a flaw, we found nothing. CVE-2026-68121 (“PPPoEject”) has been publicly disclosed, but whether exploit code was released was not established.

What this means for an Australian website: attackers do not care which country a server is in. The four KEV entries above show that Linux kernel flaws were being used in real attacks this year. With a HIGH rating and a disclosed privilege-escalation flaw in the list, there is no good reason to wait for confirmation before updating.

What should you do now?

In this order:

1. Find out which kernel your server is running. Whoever manages the server can check this. On Ubuntu, the command uname -r shows the running kernel, for example 6.8.0-147-generic. Compare it with the list above. If you are on managed or shared hosting, ask the hosting company whether USN-8917-1 has been applied and whether the server has been rebooted since.
2. Install the update. A standard system update brings in the fixed packages. Ubuntu’s standard kernel packages, such as linux-generic and linux-virtual, pull in the new kernel automatically unless someone has manually uninstalled them.
3. Reboot the server. Ubuntu says: “After a standard system update you need to reboot your computer to make all the necessary changes.” Plan a short outage for your website while this happens, and check the site comes back afterwards.
4. Rebuild any third-party kernel modules. These are add-on drivers that do not come from Ubuntu. Ubuntu says an “unavoidable ABI change” gives the kernel a new version number, which “requires you to recompile and reinstall all third party kernel modules you might have installed.” Most website servers have none, but whoever manages yours should confirm.
5. Check for compromise. Ubuntu has published no signs of compromise for this notice. If the server or website has shown anything nobody can explain in recent weeks, have it reviewed before assuming the update settled it.
6. If you find evidence of compromise, treat it as an incident. Updating closes the holes; it does not remove anyone already inside. Have a qualified person decide whether the server can be cleaned or needs to be rebuilt.
7. Record what you did. Write down the date, the kernel version before and after, and when the server was rebooted. The next time a notice like this comes out, you will know where you started.
8. Reduce your exposure. Because the known flaws need a foothold, keep the website itself up to date and remove plugins, themes and accounts nobody uses. Fewer ways in means fewer chances for a local flaw to matter.

If step one is already beyond what you can find out about your own website, that is the problem this blog exists to talk about. Skip to the bottom.

Why updating is not the whole fix

The update stops these flaws being used from the moment the server reboots. It does nothing about the time before that.

CVE-2026-68121 was publicly disclosed by 19 September 2026, more than three weeks before this notice was published on 13 October. Every day between disclosure and reboot is a day the server was running a kernel with a known hole in it. Every day after 13 October that the server goes without a reboot adds to that window.

The update also undoes nothing. If someone gained access to the server before it was patched, they keep whatever they set up. A new kernel does not remove a hidden account, a planted file or a stolen password. Ubuntu has not published guidance on checking for these, so it falls to whoever looks after the server to decide whether a check is needed.

Then there is the reboot itself. Kernel updates are easy to install and easy to forget, because nothing visible changes until someone restarts the machine. Plenty of servers have the fix sitting on disk and the old kernel still running.

That raises the question of who is actually watching the site. On managed hosting, the host looks after the server, and the kernel is theirs to update. The agency that built the website has usually moved on to the next project. The plugin updates and the website software, which are the foothold these kernel flaws need, belong to no one. And if your site runs on a server someone set up years ago, the reboot is someone’s job, but often nobody has been told it is theirs.

What this looks like with BLACKBX

BLACKBX scans every site it looks after daily against published security advisories, including Ubuntu’s security notices. When a client’s site matches a critical advisory, our developers patch it immediately. Lower-severity items are done at the next service. Every update is dated and recorded in the client’s logbook, so there is always an answer to “which kernel are we on, and when did it change?”

On the Monitor plan, the finding goes to your own developer with the version numbers and our advice, so they know exactly what to do. On Maintenance and Full service, BLACKBX does the work. All plans are monthly, with no minimum term.

Timeline

Date	Event
1 May 2026	CISA adds Linux kernel flaw CVE-2026-31431 to its Known Exploited Vulnerabilities catalogue. It is not in USN-8917-1’s list; included for context.
18 September 2026	CISA adds Linux kernel flaws CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 to the KEV catalogue. They are not in USN-8917-1’s list; included for context.
19 September 2026	The Hacker News reports that CVE-2026-68121 (“PPPoEject”), a local privilege-escalation flaw, has been disclosed by researcher Asim Manizada.
8 October 2026	Ubuntu publishes an earlier kernel notice, USN-8903-1.
9 October 2026	Ubuntu publishes USN-8911-1 for OEM kernels.
13 October 2026	Ubuntu publishes USN-8917-1 with fixed kernels for Ubuntu 24.04 LTS.
14 October 2026	This article published.

Sources

• USN-8917-1: Linux kernel vulnerabilities, Canonical / Ubuntu, 13 October 2026
• USN-8918-1: Linux kernel (Azure) vulnerabilities, Canonical / Ubuntu
• USN-8911-1: Linux kernel (OEM) vulnerabilities, Canonical / Ubuntu, 9 October 2026
• USN-8903-1: Linux kernel vulnerabilities, Canonical / Ubuntu, 8 October 2026
• CISA Adds One Known Exploited Vulnerability to Catalog, CISA, 1 May 2026
• CISA BOD 26-04 Timelines for Three Linux Kernel CVEs, Qualys, 23 September 2026
• CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild, The Hacker News, 19 September 2026
• U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog, Security Affairs
• Package “linux-tools-common” (noble 24.04), UbuntuUpdates.org