Back to Security Advisories

Linux Kernel (NVIDIA Tegra) Vulnerabilities — Ubuntu Security Update (USN-9002-1)

USN-9001-series updates the NVIDIA Tegra kernel on Ubuntu, fixing io_uring canceled-task-work mishandling that executed operations in the wrong task context (local privilege escalation class) plus CVE-2024-40954, CVE-2025-38261, CVE-2025-68296, CVE-2025-68730, CVE-2025-68768, CVE-2026-23346 and further backports. Update and reboot: sudo apt update && sudo apt upgrade, then restart into the new kernel.

High
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

io_uring wrong-task-context execution is a local privilege escalation primitive — crafted wait operations run attacker work in another task's context, breaking user isolation on Tegra-based ARM devices.

It was discovered that the io_uring subsystem in the Linux kernel did not
properly handle canceled task work when processing certain wait operations,
leading to the operation being performed in the wrong task context. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2026-81010)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– ARM32 architecture;
– ARM64 architecture;
– MIPS architecture;
– OpenRISC architecture;
– PowerPC architecture;
– RISC-V architecture;
– S390 architecture;
– x86 architecture;
– Intel NPU Driver;
– ACPI drivers;
– Serial ATA and Parallel ATA drivers;
– Auxiliary display drivers;
– Ublk userspace block driver;
– Bluetooth drivers;
– Character device driver;
– CPU idle management framework;
– Hardware crypto device drivers;
– CXL (Compute Express Link) drivers;
– ARM SCMI message protocol;
– GPIO subsystem;
– GPU drivers;
– HID subsystem;
– HSI subsystem;
– Hardware monitoring drivers;
– I2C subsystem;
– I3C subsystem;
– IIO subsystem;
– InfiniBand drivers;
– Input Device core drivers;
– On-Chip Interconnect management framework;
– IOMMU subsystem;
– Multiple devices driver;
– Media drivers;
– Fastrpc Driver;
– Amazon Nitro Secure Module driver;
– MMC subsystem;
– MTD block device drivers;
– Ethernet bonding driver;
– Network drivers;
– Microsoft Azure Network Adapter (MANA) driver;
– Texas Instruments network drivers;
– MediaTek network drivers;
– NTB driver;
– NVDIMM (Non-Volatile Memory Device) drivers;
– NVME drivers;
– NVMEM (Non Volatile Memory) drivers;
– PCI subsystem;
– Chrome hardware platform drivers;
– x86 platform drivers;
– Power supply drivers;
– RapidIO drivers;
– Voltage and Current Regulator drivers;
– S/390 drivers;
– SCSI subsystem;
– SLIMbus drivers;
– NVIDIA Tegra SoC drivers;
– Realtek RTL8723BS SDIO drivers;
– TCM subsystem;
– Trusted Execution Environment drivers;
– Thunderbolt and USB4 drivers;
– TTY drivers;
– USB Device Class drivers;
– Faraday FOTG210 USB2 dual-role controller driver;
– USB Gadget drivers;
– USB Host Controller drivers;
– Siemens ID Mouse USB driver;
– IOWarrior USB driver;
– LD Didactic USB driver;
– LEGO USB Tower driver;
– USB Serial drivers;
– USB Type-C support driver;
– USB Type-C Port Controller Manager driver;
– USB Type-C Connector System Software Interface driver;
– USB over IP driver;
– VFIO drivers;
– Framebuffer layer;
– W1 Dallas’s 1-wire bus driver;
– AFS file system;
– BTRFS file system;
– Ceph distributed file system;
– eCrypt file system;
– File systems infrastructure;
– Ext4 file system;
– F2FS file system;
– FUSE (File system in Userspace);
– Network file system (NFS) server daemon;
– NILFS2 file system;
– NTFS3 file system;
– OCFS2 file system;
– OrangeFS file system;
– SMB network file system;
– UBI file system;
– Drivers core;
– Tracing infrastructure;
– KProbes tracing;
– Networking core;
– Netfilter;
– Sun RPC protocol;
– IPv6 networking;
– Bluetooth subsystem;
– IPv4 networking;
– IP tunnels definitions;
– SCTP protocol;
– User-space API (UAPI);
– IPC subsystem;
– Audit subsystem;
– BPF subsystem;
– DMA mapping infrastructure;
– Kernel futex primitives;
– Scheduler infrastructure;
– Signal handling mechanism;
– Memory management;
– 6LoWPAN network protocol;
– IEEE 802 network protocols;
– B.A.T.M.A.N. meshing protocol;
– Ethernet bridge;
– CAN network layer;
– Ceph Core library;
– Devlink API;
– HSR network protocol;
– IEEE802154.4 network protocol;
– IUCV driver;
– MAC80211 subsystem;
– Management Component Transport Protocol (MCTP);
– MultiProtocol Label Switching driver;
– Multipath TCP;
– NetLabel subsystem;
– Open vSwitch;
– Packet sockets;
– RDS protocol;
– Network traffic control;
– SMC sockets;
– Network sockets;
– VMware vSockets driver;
– XFRM subsystem;
– AppArmor security module;
– Key management;
– Landlock security;
– Simplified Mandatory Access Control Kernel framework;
– ALSA framework;
– Digigram PCXHR ALSA driver;
– Wolfson Microelectronics audio codecs;
– USB sound devices;
– KVM subsystem;
(CVE-2024-40954, CVE-2025-38261, CVE-2025-68296, CVE-2025-68730,
CVE-2025-68768, CVE-2026-23346, CVE-2026-43219, CVE-2026-43240,
CVE-2026-43311, CVE-2026-43331, CVE-2026-45930, CVE-2026-52913,
CVE-2026-52930, CVE-2026-52939, CVE-2026-52944, CVE-2026-52948,
CVE-2026-52953, CVE-2026-53080, CVE-2026-53134, CVE-2026-53135,
CVE-2026-53140, CVE-2026-53144, CVE-2026-53150, CVE-2026-53154,
CVE-2026-53158, CVE-2026-53168, CVE-2026-53177, CVE-2026-53178,
CVE-2026-53179, CVE-2026-53181, CVE-2026-53190, CVE-2026-53208,
CVE-2026-53210, CVE-2026-53213, CVE-2026-53214, CVE-2026-53218,
CVE-2026-53219, CVE-2026-53220, CVE-2026-53227, CVE-2026-53236,
CVE-2026-53237, CVE-2026-53238, CVE-2026-53242, CVE-2026-53245,
CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53261,
CVE-2026-53263, CVE-2026-53265, CVE-2026-53274, CVE-2026-53331,
CVE-2026-53332, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339,
CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349,
CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-63868,
CVE-2026-63871, CVE-2026-63876, CVE-2026-63877, CVE-2026-63882,
CVE-2026-63883, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892,
CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898,
CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902,
CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63908,
CVE-2026-63928, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934,
CVE-2026-63943, CVE-2026-63949, CVE-2026-63956, CVE-2026-63957,
CVE-2026-63958, CVE-2026-63959, CVE-2026-63960, CVE-2026-63961,
CVE-2026-63964, CVE-2026-63967, CVE-2026-63969, CVE-2026-63973,
CVE-2026-63990, CVE-2026-63991, CVE-2026-64001, CVE-2026-64006,
CVE-2026-64012, CVE-2026-64014, CVE-2026-64078, CVE-2026-64090,
CVE-2026-64094, CVE-2026-64131, CVE-2026-64233, CVE-2026-64234,
CVE-2026-64240, CVE-2026-64305, CVE-2026-64329, CVE-2026-64330,
CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343,
CVE-2026-64344, CVE-2026-64346, CVE-2026-64348, CVE-2026-64352,
CVE-2026-64362, CVE-2026-64363, CVE-2026-64365, CVE-2026-64407,
CVE-2026-64421, CVE-2026-64424, CVE-2026-64433, CVE-2026-64446,
CVE-2026-64525, CVE-2026-64527, CVE-2026-64528, CVE-2026-74506,
CVE-2026-80590, CVE-2026-80591, CVE-2026-80593, CVE-2026-80598,
CVE-2026-80599, CVE-2026-80600, CVE-2026-80601, CVE-2026-80603,
CVE-2026-80609, CVE-2026-80613, CVE-2026-80619, CVE-2026-80622,
CVE-2026-80628, CVE-2026-80630, CVE-2026-80631, CVE-2026-80634,
CVE-2026-80635, CVE-2026-80637, CVE-2026-80644, CVE-2026-80645,
CVE-2026-80646, CVE-2026-80649, CVE-2026-80653, CVE-2026-80662,
CVE-2026-80663, CVE-2026-80664, CVE-2026-80668, CVE-2026-80677,
CVE-2026-80678, CVE-2026-80680, CVE-2026-80681, CVE-2026-80684,
CVE-2026-80691, CVE-2026-80692, CVE-2026-80693, CVE-2026-80694,
CVE-2026-80700, CVE-2026-80702, CVE-2026-80706, CVE-2026-80707,
CVE-2026-80709, CVE-2026-80710, CVE-2026-80714, CVE-2026-80716,
CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80725,
CVE-2026-80731, CVE-2026-80732, CVE-2026-80737, CVE-2026-80738,
CVE-2026-80747, CVE-2026-80752, CVE-2026-80754, CVE-2026-80840,
CVE-2026-80928, CVE-2026-80931, CVE-2026-80932, CVE-2026-80933,
CVE-2026-80935, CVE-2026-80937, CVE-2026-80944, CVE-2026-80945,
CVE-2026-80947, CVE-2026-80952, CVE-2026-80967, CVE-2026-80971,
CVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80980,
CVE-2026-80982, CVE-2026-80987, CVE-2026-80989, CVE-2026-80990,
CVE-2026-80991, CVE-2026-80992, CVE-2026-80994, CVE-2026-81000,
CVE-2026-81001, CVE-2026-81002, CVE-2026-81003, CVE-2026-81007,
CVE-2026-81008, CVE-2026-81011, CVE-2026-81012, CVE-2026-81016,
CVE-2026-81017, CVE-2026-89440, CVE-2026-89441, CVE-2026-89442,
CVE-2026-89443, CVE-2026-89448, CVE-2026-89452, CVE-2026-89456,
CVE-2026-89465, CVE-2026-89466, CVE-2026-89469, CVE-2026-89470,
CVE-2026-89471, CVE-2026-89472, CVE-2026-89476, CVE-2026-89477,
CVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481,
CVE-2026-89482, CVE-2026-89483, CVE-2026-89485, CVE-2026-89487,
CVE-2026-89488, CVE-2026-89489, CVE-2026-89492, CVE-2026-89493,
CVE-2026-89494, CVE-2026-89495, CVE-2026-89497, CVE-2026-89500,
CVE-2026-89501, CVE-2026-89502, CVE-2026-89503, CVE-2026-89504,
CVE-2026-89508, CVE-2026-89510, CVE-2026-89511, CVE-2026-89520,
CVE-2026-89524, CVE-2026-89526, CVE-2026-89528, CVE-2026-89530,
CVE-2026-89532, CVE-2026-89533, CVE-2026-89536, CVE-2026-89537,
CVE-2026-89538, CVE-2026-89540, CVE-2026-89541, CVE-2026-89542,
CVE-2026-89544, CVE-2026-89545, CVE-2026-89547, CVE-2026-89548,
CVE-2026-89549, CVE-2026-89550, CVE-2026-89551, CVE-2026-89553,
CVE-2026-89554, CVE-2026-89555, CVE-2026-89557, CVE-2026-89559,
CVE-2026-89560, CVE-2026-89561, CVE-2026-89562, CVE-2026-89563,
CVE-2026-89564, CVE-2026-89569, CVE-2026-89573, CVE-2026-89574,
CVE-2026-89579, CVE-2026-89580, CVE-2026-89583, CVE-2026-89585,
CVE-2026-89586, CVE-2026-89587, CVE-2026-89594, CVE-2026-89596,
CVE-2026-89597, CVE-2026-89599, CVE-2026-89601, CVE-2026-89605,
CVE-2026-89606, CVE-2026-89607, CVE-2026-89608, CVE-2026-89609,
CVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89622,
CVE-2026-89626, CVE-2026-89631, CVE-2026-89633, CVE-2026-89634,
CVE-2026-89636, CVE-2026-89637, CVE-2026-89638, CVE-2026-89640,
CVE-2026-89643, CVE-2026-89647, CVE-2026-89648, CVE-2026-89649,
CVE-2026-89650, CVE-2026-89652, CVE-2026-89653, CVE-2026-89654,
CVE-2026-89655, CVE-2026-89656, CVE-2026-89657, CVE-2026-89659,
CVE-2026-89662, CVE-2026-89663, CVE-2026-89665, CVE-2026-89669,
CVE-2026-89671, CVE-2026-89672, CVE-2026-89674, CVE-2026-89676,
CVE-2026-89680, CVE-2026-89682, CVE-2026-89684, CVE-2026-89685,
CVE-2026-89686, CVE-2026-89690, CVE-2026-89691, CVE-2026-89694,
CVE-2026-89696, CVE-2026-89697, CVE-2026-89699, CVE-2026-89702,
CVE-2026-89704, CVE-2026-89705, CVE-2026-89706, CVE-2026-89707,
CVE-2026-89708, CVE-2026-89709, CVE-2026-89711, CVE-2026-89712,
CVE-2026-89713, CVE-2026-89720, CVE-2026-89723, CVE-2026-89724,
CVE-2026-89725, CVE-2026-89729, CVE-2026-89731, CVE-2026-89733,
CVE-2026-89736, CVE-2026-89738, CVE-2026-89742, CVE-2026-89743,
CVE-2026-89747, CVE-2026-89750, CVE-2026-89755, CVE-2026-89761,
CVE-2026-89762, CVE-2026-89763, CVE-2026-89774, CVE-2026-89777,
CVE-2026-89778, CVE-2026-89779, CVE-2026-89781, CVE-2026-89782,
CVE-2026-89783, CVE-2026-89786, CVE-2026-89788, CVE-2026-89789,
CVE-2026-89792, CVE-2026-89793, CVE-2026-89795, CVE-2026-89799,
CVE-2026-89801, CVE-2026-89803, CVE-2026-89806, CVE-2026-89808,
CVE-2026-89810, CVE-2026-89811, CVE-2026-89819, CVE-2026-89823,
CVE-2026-89832, CVE-2026-89838, CVE-2026-89840, CVE-2026-89844,
CVE-2026-89846, CVE-2026-89847, CVE-2026-89848, CVE-2026-89849,
CVE-2026-89854, CVE-2026-89856, CVE-2026-89857, CVE-2026-89860,
CVE-2026-89861, CVE-2026-89863, CVE-2026-89870, CVE-2026-89877,
CVE-2026-89880, CVE-2026-89883, CVE-2026-89887, CVE-2026-89888,
CVE-2026-89890, CVE-2026-89893, CVE-2026-89894, CVE-2026-89897,
CVE-2026-89899, CVE-2026-89902, CVE-2026-89903, CVE-2026-89908,
CVE-2026-89912, CVE-2026-89920, CVE-2026-89922, CVE-2026-89927,
CVE-2026-89929, CVE-2026-89930, CVE-2026-89932, CVE-2026-89938,
CVE-2026-89951, CVE-2026-89954, CVE-2026-89957, CVE-2026-89959,
CVE-2026-89960, CVE-2026-89961, CVE-2026-89965, CVE-2026-89968,
CVE-2026-89969, CVE-2026-89970, CVE-2026-89972, CVE-2026-89973,
CVE-2026-89979, CVE-2026-89988, CVE-2026-89992, CVE-2026-89995,
CVE-2026-89997, CVE-2026-89998, CVE-2026-89999, CVE-2026-90000,
CVE-2026-90002, CVE-2026-90003, CVE-2026-90007, CVE-2026-90011,
CVE-2026-90013, CVE-2026-90016, CVE-2026-90017, CVE-2026-90018,
CVE-2026-90022, CVE-2026-90025, CVE-2026-90026, CVE-2026-90027,
CVE-2026-90032, CVE-2026-90036, CVE-2026-90037, CVE-2026-90041,
CVE-2026-90042, CVE-2026-90044, CVE-2026-90045, CVE-2026-90048,
CVE-2026-90049, CVE-2026-90170, CVE-2026-92502, CVE-2026-93221)

Frequently Asked Questions

What is the USN-9001-series Tegra kernel update?
It is Ubuntu's kernel security update for the NVIDIA Tegra flavor, fixing an io_uring flaw where canceled task work executed in the wrong task context (local privilege escalation class), plus CVE-2024-40954, CVE-2025-38261, CVE-2025-68296, CVE-2025-68730, CVE-2025-68768, CVE-2026-23346 and further backported fixes.
Who runs the Tegra kernel?
NVIDIA Jetson boards and Tegra-based ARM devices running Ubuntu — edge and embedded deployments.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade and reboot into the new kernel; verify with uname -r reporting the updated Tegra build.
Why is io_uring a recurring security topic?
io_uring's async model moves work between task contexts — getting cancellation and ownership right under all races is hard, which is why several io_uring privilege-escalation CVEs have shipped across kernels recently.

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System