Back to Security Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

USN-9018-2 ships updated Linux kernel packages for the hardware enablement (HWE) track on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, fixing one of the largest correction batches in this series: 379 distinct CVE identifiers are listed. Corrections span network file systems, the stream parser, architecture-specific code (ARM64, PowerPC, RISC-V, S390, UML, x86), the block layer, Android/Bluetooth/TPM drivers, DPLL, EDAC and GPIO subsystems, with the notice's own severity data reaching CVSS 7.8.

High 7.8 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

HWE kernels are what Ubuntu 20.04 servers run to get newer hardware support, so this track is common on hosting hardware. With flaws spanning memory management and drivers — the notice cites NULL-pointer class issues (CWE-476) at a CVSS 7.8 ceiling — patch on the routine cycle and reboot to load the corrected kernel.

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– Network file systems library;
– Stream parser;
– ARM64 architecture;
– PowerPC architecture;
– RISC-V architecture;
– S390 architecture;
– User-Mode Linux (UML);
– x86 architecture;
– Block layer subsystem;
– Android drivers;
– Bluetooth drivers;
– TPM device driver;
– DPLL subsystem;
– EDAC drivers;
– GPIO subsystem;
– GPU drivers;
– HID subsystem;
– IIO subsystem;
– IIO ADC drivers;
– InfiniBand drivers;
– Input Device (Miscellaneous) drivers;
– Multiple devices driver;
– MemoryStick subsystem;
– MMC subsystem;
– MTD block device drivers;
– Network drivers;
– Ethernet bonding driver;
– Mellanox network drivers;
– STMicroelectronics network drivers;
– Ethernet team driver;
– MediaTek network drivers;
– NVME drivers;
– Device tree and open firmware driver;
– Power sequencing drivers;
– Voltage and Current Regulator drivers;
– Real Time Clock drivers;
– SCSI subsystem;
– Greybus lights staging drivers;
– Trusted Execution Environment drivers;
– Thunderbolt and USB4 drivers;
– TTY drivers;
– Cadence USB3 driver;
– USB Device Class drivers;
– USB core drivers;
– DesignWare USB2 driver;
– DesignWare USB3 driver;
– USB Gadget drivers;
– USB Serial drivers;
– USB Mass Storage drivers;
– USB Type-C support driver;
– USB Type-C Port Controller Manager driver;
– TI TPS6598x USB Power Delivery controller driver;
– USB Type-C Connector System Software Interface driver;
– Amazon Nitro Enclaves driver;
– Virtual machine generation ID driver;
– BTRFS file system;
– File systems infrastructure;
– SMB network file system;
– XFS file system;
– BPF subsystem;
– io_uring subsystem;
– Netfilter;
– Namespaces infrastructure;
– Networking core;
– Networking subsytem;
– Virtio network driver;
– Bluetooth subsystem;
– IPv4 networking;
– Network traffic control;
– Audit subsystem;
– Control group (cgroup);
– Perf events;
– Kernel fork() syscall;
– Kernel futex primitives;
– KProbes tracing;
– Kexec HandOver (KHO);
– Kernel module support;
– Tracing infrastructure;
– Workqueue subsystem;
– Memory management;
– Ethernet bridge;
– Devlink API;
– IPv6 networking;
– MAC80211 subsystem;
– Management Component Transport Protocol (MCTP);
– Open vSwitch;
– Packet sockets;
– SCTP protocol;
– SMC sockets;
– TIPC protocol;
– VMware vSockets driver;
– Wireless networking;
– XFRM subsystem;
– Drivers core;
– Key management;
– SELinux security module;
– ALSA framework;
– Creative Sound Blaster X-Fi driver;
– Analog Devices audio codecs;
– Maxim audio codecs;
– Realtek audio codecs;
– QCOM ASoC drivers;
– Samsung ASoC drivers;
– SoundWire (SDCA) ASoC drivers;
– USB sound devices;
(CVE-2026-68305, CVE-2026-72404, CVE-2026-72497, CVE-2026-74527,
CVE-2026-74568, CVE-2026-89568, CVE-2026-89764, CVE-2026-89907,
CVE-2026-90144, CVE-2026-90155, CVE-2026-90162, CVE-2026-90167,
CVE-2026-90317, CVE-2026-93175, CVE-2026-98038, CVE-2026-98375,
CVE-2026-98432, CVE-2026-98655, CVE-2026-98656, CVE-2026-98657,
CVE-2026-98658, CVE-2026-98659, CVE-2026-98660, CVE-2026-98661,
CVE-2026-98662, CVE-2026-98663, CVE-2026-98664, CVE-2026-98665,
CVE-2026-98666, CVE-2026-98667, CVE-2026-98668, CVE-2026-98669,
CVE-2026-98670, CVE-2026-98671, CVE-2026-98672, CVE-2026-98673,
CVE-2026-98674, CVE-2026-98675, CVE-2026-98676, CVE-2026-98677,
CVE-2026-98678, CVE-2026-98679, CVE-2026-98680, CVE-2026-98681,
CVE-2026-98682, CVE-2026-98683, CVE-2026-98684, CVE-2026-98685,
CVE-2026-98686, CVE-2026-98687, CVE-2026-98689, CVE-2026-98690,
CVE-2026-98691, CVE-2026-98692, CVE-2026-98693, CVE-2026-98694,
CVE-2026-98695, CVE-2026-98696, CVE-2026-98697, CVE-2026-98698,
CVE-2026-98699, CVE-2026-98700, CVE-2026-98701, CVE-2026-98702,
CVE-2026-98703, CVE-2026-98704, CVE-2026-98705, CVE-2026-98706,
CVE-2026-98707, CVE-2026-98708, CVE-2026-98709, CVE-2026-98710,
CVE-2026-98711, CVE-2026-98712, CVE-2026-98713, CVE-2026-98714,
CVE-2026-98715, CVE-2026-98716, CVE-2026-98717, CVE-2026-98718,
CVE-2026-98719, CVE-2026-98720, CVE-2026-98721, CVE-2026-98722,
CVE-2026-98723, CVE-2026-98724, CVE-2026-98725, CVE-2026-98726,
CVE-2026-98727, CVE-2026-98728, CVE-2026-98729, CVE-2026-98730,
CVE-2026-98731, CVE-2026-98732, CVE-2026-98733, CVE-2026-98734,
CVE-2026-98735, CVE-2026-98736, CVE-2026-98737, CVE-2026-98738,
CVE-2026-98739, CVE-2026-98740, CVE-2026-98741, CVE-2026-98742,
CVE-2026-98743, CVE-2026-98744, CVE-2026-98745, CVE-2026-98746,
CVE-2026-98747, CVE-2026-98748, CVE-2026-98749, CVE-2026-98750,
CVE-2026-98751, CVE-2026-98752, CVE-2026-98753, CVE-2026-98754,
CVE-2026-98755, CVE-2026-98756, CVE-2026-98757, CVE-2026-98758,
CVE-2026-98759, CVE-2026-98760, CVE-2026-98761, CVE-2026-98762,
CVE-2026-98763, CVE-2026-98764, CVE-2026-98765, CVE-2026-98766,
CVE-2026-98767, CVE-2026-98768, CVE-2026-98769, CVE-2026-98770,
CVE-2026-98771, CVE-2026-98772, CVE-2026-98773, CVE-2026-98774,
CVE-2026-98775, CVE-2026-98776, CVE-2026-98777, CVE-2026-98778,
CVE-2026-98779, CVE-2026-98780, CVE-2026-98781, CVE-2026-98782,
CVE-2026-98783, CVE-2026-98784, CVE-2026-98785, CVE-2026-98786,
CVE-2026-98788, CVE-2026-98789, CVE-2026-98790, CVE-2026-98791,
CVE-2026-98792, CVE-2026-98793, CVE-2026-98794, CVE-2026-98795,
CVE-2026-98796, CVE-2026-98797, CVE-2026-98798, CVE-2026-98799,
CVE-2026-98800, CVE-2026-98801, CVE-2026-98802, CVE-2026-98803,
CVE-2026-98804, CVE-2026-98805, CVE-2026-98806, CVE-2026-98807,
CVE-2026-98808, CVE-2026-98809, CVE-2026-98810, CVE-2026-98811,
CVE-2026-98812, CVE-2026-98813, CVE-2026-98814, CVE-2026-98816,
CVE-2026-98817, CVE-2026-98818, CVE-2026-98819, CVE-2026-98820,
CVE-2026-98821, CVE-2026-98822, CVE-2026-98823, CVE-2026-98824,
CVE-2026-98825, CVE-2026-98826, CVE-2026-98827, CVE-2026-98828,
CVE-2026-98829, CVE-2026-98830, CVE-2026-98831, CVE-2026-98833,
CVE-2026-98834, CVE-2026-98835, CVE-2026-98836, CVE-2026-98837,
CVE-2026-98838, CVE-2026-98839, CVE-2026-98840, CVE-2026-98841,
CVE-2026-98842, CVE-2026-98843, CVE-2026-98844, CVE-2026-98845,
CVE-2026-98846, CVE-2026-98847, CVE-2026-98848, CVE-2026-98849,
CVE-2026-98850, CVE-2026-98851, CVE-2026-98852, CVE-2026-98853,
CVE-2026-98854, CVE-2026-98855, CVE-2026-98856, CVE-2026-98857,
CVE-2026-98858, CVE-2026-98859, CVE-2026-98860, CVE-2026-98861,
CVE-2026-98862, CVE-2026-98863, CVE-2026-98931, CVE-2026-98932,
CVE-2026-98933, CVE-2026-98934, CVE-2026-98935, CVE-2026-98936,
CVE-2026-98937, CVE-2026-98939, CVE-2026-98940, CVE-2026-98944,
CVE-2026-98945, CVE-2026-98946, CVE-2026-98947, CVE-2026-98948,
CVE-2026-98949, CVE-2026-98950, CVE-2026-98951, CVE-2026-98952,
CVE-2026-98953, CVE-2026-98954, CVE-2026-98955, CVE-2026-98956,
CVE-2026-98957, CVE-2026-98958, CVE-2026-98959, CVE-2026-98960,
CVE-2026-98961, CVE-2026-98962, CVE-2026-98963, CVE-2026-98964,
CVE-2026-98965, CVE-2026-98966, CVE-2026-98967, CVE-2026-98968,
CVE-2026-98969, CVE-2026-98970, CVE-2026-98971, CVE-2026-98972,
CVE-2026-98973, CVE-2026-98974, CVE-2026-98975, CVE-2026-98977,
CVE-2026-98978, CVE-2026-98979, CVE-2026-98980, CVE-2026-98981,
CVE-2026-98982, CVE-2026-98983, CVE-2026-98984, CVE-2026-98985,
CVE-2026-98986, CVE-2026-98987, CVE-2026-98988, CVE-2026-98989,
CVE-2026-98990, CVE-2026-98991, CVE-2026-98992, CVE-2026-98993,
CVE-2026-98994, CVE-2026-98995, CVE-2026-98996, CVE-2026-98997,
CVE-2026-98999, CVE-2026-99000, CVE-2026-99001, CVE-2026-99002,
CVE-2026-99003, CVE-2026-99004, CVE-2026-99005, CVE-2026-99006,
CVE-2026-99007, CVE-2026-99008, CVE-2026-99009, CVE-2026-99010,
CVE-2026-99011, CVE-2026-99012, CVE-2026-99013, CVE-2026-99014,
CVE-2026-99015, CVE-2026-99016, CVE-2026-99017, CVE-2026-99018,
CVE-2026-99019, CVE-2026-99020, CVE-2026-99021, CVE-2026-99022,
CVE-2026-99023, CVE-2026-99024, CVE-2026-99025, CVE-2026-99026,
CVE-2026-99027, CVE-2026-99028, CVE-2026-99029, CVE-2026-99030,
CVE-2026-99031, CVE-2026-99032, CVE-2026-99033, CVE-2026-99034,
CVE-2026-99035, CVE-2026-99036, CVE-2026-99037, CVE-2026-99038,
CVE-2026-99039, CVE-2026-99040, CVE-2026-99041, CVE-2026-99043,
CVE-2026-99044, CVE-2026-99045, CVE-2026-99046, CVE-2026-99047,
CVE-2026-99048, CVE-2026-99049, CVE-2026-99050, CVE-2026-99051,
CVE-2026-99052, CVE-2026-99053, CVE-2026-99054, CVE-2026-99055,
CVE-2026-99056, CVE-2026-99057, CVE-2026-99058, CVE-2026-99059,
CVE-2026-99060, CVE-2026-99061, CVE-2026-99062, CVE-2026-99063,
CVE-2026-99064, CVE-2026-99065, CVE-2026-99066, CVE-2026-99067,
CVE-2026-99068, CVE-2026-99069, CVE-2026-99070, CVE-2026-99071,
CVE-2026-99072, CVE-2026-99073, CVE-2026-99074, CVE-2026-99075,
CVE-2026-99076, CVE-2026-99077, CVE-2026-99078, CVE-2026-99079,
CVE-2026-99080, CVE-2026-99081, CVE-2026-99088, CVE-2026-99089,
CVE-2026-99090, CVE-2026-99091, CVE-2026-99092, CVE-2026-99093,
CVE-2026-99094, CVE-2026-99095, CVE-2026-99096, CVE-2026-99097,
CVE-2026-99098, CVE-2026-99099, CVE-2026-99999)

Frequently Asked Questions

What is the HWE kernel and why does this notice matter for it?
The Hardware Enablement kernel lets older Ubuntu LTS releases run newer kernels; servers that need newer hardware support run it, making USN-9018-2 relevant beyond the default kernel tracks.
How large is this update?
379 distinct CVE identifiers are listed in the notice, spanning network file systems, stream parsing, multiple architectures, the block layer and a wide set of drivers.
What should operators do?
Update the kernel packages via standard apt tooling and reboot — kernel fixes only protect once the server boots into the new kernel.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System