USN-8957-1: authd vulnerability
USN-8957-1
Summary
Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture
- ARM64 architecture
- MIPS architecture
- PowerPC architecture
- S390 architecture
- x86 architecture
- Block layer subsystem
- Cryptographic API
- ACPI drivers
- ATM drivers
- Drivers core
- Power management core
- DRBD Distributed Replicated Block Device drivers
- RNBD block device driver
- Bluetooth drivers
- Bus devices
- Character device driver
- TPM device driver
- Clocksource drivers
- Data acquisition framework and drivers
- CPU frequency scaling framework
- CPU idle management framework
- Hardware crypto device drivers
- DMA engine subsystem
- Arm Firmware Framework for ARMv8-A(FFA)
- EFI core
- GPIO subsystem
- GPU drivers
- HID subsystem
- Hardware monitoring drivers
- I2C subsystem
- IIO subsystem
- IIO ADC drivers
- InfiniBand drivers
- Input Device (Miscellaneous) drivers
- IOMMU subsystem
- Mailbox framework
- Multiple devices driver
- Media drivers
- MediaTek SMI driver
- NVIDIA Tegra memory controller driver
- Multifunction device drivers
- IBM Advanced System Management driver
- MMC subsystem
- MTD block device drivers
- Network drivers
- Ethernet bonding driver
- Mellanox network drivers
- Microsoft Azure Network Adapter (MANA) driver
- STMicroelectronics network drivers
- MediaTek network drivers
- Near Field Communication (NFC) drivers
- NTB driver
- NVDIM
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
This update corrects flaws in the following subsystems:
- ARM32 architecture
- ARM64 architecture
- MIPS architecture
- PowerPC architecture
- S390 architecture
- x86 architecture
- Block layer subsystem
- Cryptographic API
- ACPI drivers
- ATM drivers
- Drivers core
- Power management core
- DRBD Distributed Replicated Block Device drivers
- RNBD block device driver
- Bluetooth drivers
- Bus devices
- Character device driver
- TPM device driver
- Clocksource drivers
- Data acquisition framework and drivers
- CPU frequency scaling framework
- CPU idle management framework
- Hardware crypto device drivers
- DMA engine subsystem
- Arm Firmware Framework for ARMv8-A(FFA)
- EFI core
- GPIO subsystem
- GPU drivers
- HID subsystem
- Hardware monitoring drivers
- I2C
CVEs in this advisory 3
Updates
- Published by Ubuntu
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.