● Ubuntu USN · September 2026

Ubuntu Linux Security Advisory: September 2026 Kernel & Subsystem Triage

Triage of Ubuntu's September 2026 kernel rollups addressing critical io_uring memory corruption, eBPF verifier bounds, and network packet handling vulnerabilities.

Kernel CVEs Fixed

In-The-Wild Exploit

7.8

CVSS io_uring Flaw

High

Server Patch Urgency

漏洞风险分类与修复裁决

Canonical released coordinated Ubuntu Security Notices (USN) across 24.04 LTS and 22.04 LTS addressing 34 kernel security issues. The critical highlight is CVE-2024-0582 in the io_uring subsystem, an actively targeted use-after-free flaw that allows unprivileged local attackers to elevate privileges to root.

重点漏洞分类评级矩阵

CVE 编号	核心子系统 / 组件	影响程度	CVSS	是否在野利用？
CVE-2024-0582	io_uring / Ring Buffer	Use-After-Free / LPE	7.8 High	YES (In-The-Wild)
CVE-2024-41090	eBPF Verifier	Bounds Check Bypass	7.1 High	No
CVE-2024-41091	Bluetooth L2CAP	Null Pointer Dereference	6.5 Medium	No
CVE-2024-41092	Ext4 Filesystem	Out-of-Bounds Read	5.5 Medium	No

深度源码剖析

Deep Dive: Linux Kernel io_uring Privilege Escalation Teardown →

Inspect the exact C diff from fs/io_uring.c showing how registering an existing ring buffer caused a premature reference drop and slab-use-after-free.

← 浏览完整安全目录所有平台安全更新 →