Вернуться к предупреждениям о безопасности

Linux Kernel (NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9003-1)

USN-9003-1 updates the NVIDIA kernel on Ubuntu, fixing CVE-2023-20585 (AMD processor Reverse Map Table checks skipped when the IOMMU accessed certain host buffers — allowing confidentiality compromise of SEV-SNP protected memory) plus CVE-2026-64349, CVE-2026-64530/64532/64533/64534/64535 and further backports, aggregate CVSS 5.6 (CWE-788). Update and reboot: sudo apt update && sudo apt upgrade, then restart into the new kernel.

High 5.6 CVSS
Ubuntu 20.04 Ubuntu 22.04

Что это значит по лицензии SharedLicense

Confidentiality of SEV-SNP-protected memory is the entire promise of confidential computing — an IOMMU-triggered out-of-bounds condition that compromises that integrity defeats the encryption isolation cloud customers pay for.

  • CVE-2026-92502
  • CVE-2026-89774
  • CVE-2026-80886
  • CVE-2026-80885
  • CVE-2026-80884
  • CVE-2026-80883
  • CVE-2026-80882
  • CVE-2026-80881
  • CVE-2026-80880
  • CVE-2026-80879
  • CVE-2026-80878
  • CVE-2026-80877
  • CVE-2026-80876
  • CVE-2026-80875
  • CVE-2026-80874
  • CVE-2026-80873
  • CVE-2026-80872
  • CVE-2026-80871
  • CVE-2026-80870
  • CVE-2026-80868
  • CVE-2026-80867
  • CVE-2026-80866
  • CVE-2026-80865
  • CVE-2026-80677
  • CVE-2026-80676
  • CVE-2026-80675
  • CVE-2026-80671
  • CVE-2026-80670
  • CVE-2026-80669
  • CVE-2026-80668
  • CVE-2026-80667
  • CVE-2026-80666
  • CVE-2026-80665
  • CVE-2026-80664
  • CVE-2026-80663
  • CVE-2026-80662
  • CVE-2026-80661
  • CVE-2026-80660
  • CVE-2026-80659
  • CVE-2026-80658
  • CVE-2026-80657
  • CVE-2026-80655
  • CVE-2026-80654
  • CVE-2026-80653
  • CVE-2026-80652
  • CVE-2026-80651
  • CVE-2026-80650
  • CVE-2026-80649
  • CVE-2026-80648
  • CVE-2026-80647
  • CVE-2026-80646
  • CVE-2026-80645
  • CVE-2026-80644
  • CVE-2026-80643
  • CVE-2026-80642
  • CVE-2026-80641
  • CVE-2026-80640
  • CVE-2026-80639
  • CVE-2026-80638
  • CVE-2026-80637
  • CVE-2026-80636
  • CVE-2026-80635
  • CVE-2026-80634
  • CVE-2026-80631
  • CVE-2026-80630
  • CVE-2026-80629
  • CVE-2026-80628
  • CVE-2026-80627
  • CVE-2026-80626
  • CVE-2026-80625
  • CVE-2026-80624
  • CVE-2026-80623
  • CVE-2026-80622
  • CVE-2026-80621
  • CVE-2026-80620
  • CVE-2026-80619
  • CVE-2026-80618
  • CVE-2026-80617
  • CVE-2026-80616
  • CVE-2026-80615
  • CVE-2026-80614
  • CVE-2026-80613
  • CVE-2026-80612
  • CVE-2026-80611
  • CVE-2026-80610
  • CVE-2026-80609
  • CVE-2026-80607
  • CVE-2026-80606
  • CVE-2026-80605
  • CVE-2026-80604
  • CVE-2026-80603
  • CVE-2026-80602
  • CVE-2026-80601
  • CVE-2026-80600
  • CVE-2026-80599
  • CVE-2026-80598
  • CVE-2026-80597
  • CVE-2026-80596
  • CVE-2026-80595
  • CVE-2026-80594
  • CVE-2026-80593
  • CVE-2026-80592
  • CVE-2026-74439
  • CVE-2026-74438
  • CVE-2026-74437
  • CVE-2026-74436
  • CVE-2026-74435
  • CVE-2026-74434
  • CVE-2026-74433
  • CVE-2026-74432
  • CVE-2026-74431
  • CVE-2026-74430
  • CVE-2026-74429
  • CVE-2026-74428
  • CVE-2026-74427
  • CVE-2026-74426
  • CVE-2026-74425
  • CVE-2026-74424
  • CVE-2026-74423
  • CVE-2026-74422
  • CVE-2026-74421
  • CVE-2026-74420
  • CVE-2026-74419
  • CVE-2026-74417
  • CVE-2026-74416
  • CVE-2026-74415
  • CVE-2026-74413

    • Часто задаваемые вопросы

    What is the AMD RMP / IOMMU flaw in this update?
    It is a processor-side flaw (CVE-2023-20585 class): some AMD processors did not perform Reverse Map Table checks when the IOMMU accessed certain host buffers, letting a local attacker with hypervisor access trigger an out-of-bounds condition and compromise the integrity of SEV-SNP protected memory.
    Who is affected?
    Ubuntu hosts on AMD processors using SEV-SNP confidential computing with IOMMU passthrough — cloud confidential-computing deployments. Servers without AMD SEV-SNP guests are largely unaffected by the confidentiality angle.
    How do I apply the fix?
    Run sudo apt update && sudo apt upgrade and reboot — processor microcode/firmware coordination may also be required per the platform vendor's guidance for full RMP handling.
    Why does a CPU flaw arrive in a kernel update?
    The kernel enables and coordinates the RMP checks around IOMMU access — the kernel-side handling plus updated firmware closes the guest-triggered path, so both must be current.

    Источники

    Предупреждения о безопасности

    Похожие предупреждения

    Tornado Regression — Ubuntu Security Update (USN-8952-3)

    2026-11-11

    Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

    2026-11-11

    Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

    2026-11-11

    Проверьте систему на уязвимости

    Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

    Проверьте свою систему