USN-8957-1: authd vulnerability
USN-8957-1
Summary
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers
- ARM64 architecture
- Cryptographic API
- PSP security protocol
- User-space API (UAPI)
- Kernel build system
- ARM32 architecture
- MIPS architecture
- PowerPC architecture
- RISC-V architecture
- S390 architecture
- User-Mode Linux (UML)
- x86 architecture
- Block layer subsystem
- Compute Acceleration Framework
- Intel NPU Driver
- ACPI drivers
- Android drivers
- Auxiliary display drivers
- Drivers core
- DRBD Distributed Replicated Block Device drivers
- Rados block device (RBD) driver
- Ublk userspace block driver
- Compressed RAM block device driver
- Bluetooth drivers
- Bus devices
- Character device driver
- Hardware random number generator core
- Clock framework and drivers
- CPU frequency scaling framework
- Hardware crypto device drivers
- Buffer Sharing and Synchronization framework
- DPLL subsystem
- EDAC drivers
- Arm Firmware Framework for ARMv8-A(FFA)
- EFI core
- Intel Stratix 10 firmware drivers
- FPGA Framework
- FWCTL subsystem
- GPIO subsystem
- GPU drivers
- HID subsystem
- Hardware monitoring drivers
- CoreSight HW tracing drivers
- I2C subsystem
- I3C subsystem
- IIO subsystem
- IIO ADC drivers
- InfiniBand drivers
- Input Device core drivers
- Input Device (Mouse) drivers
- IOMMU subsystem
- IRQ chip drivers
- Mailbox framework
- Multiple devices driver
- Media drivers
- NVIDIA Tegra memory controller driver
- Multifunction device drivers
- Fastrpc Driver
- MMC subsystem
- MTD block device drivers
- Network drivers
- Ethernet bo
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
This update corrects flaws in the following subsystems:
- x86 platform drivers
- ARM64 architecture
- Cryptographic API
- PSP security protocol
- User-space API (UAPI)
- Kernel build system
- ARM32 architecture
- MIPS architecture
- PowerPC architecture
- RISC-V architecture
- S390 architecture
- User-Mode Linux (UML)
- x86 architecture
- Block layer subsystem
- Compute Acceleration Framework
- Intel NPU Driver
- ACPI drivers
- Android drivers
- Auxiliary display drivers
- Drivers core
- DRBD Distributed Replicated Block Device drivers
- Rados block device (RBD) driver
- Ublk userspace block driver
- Compressed RAM block device driver
- Bluetooth drivers
- Bus devices
- Character device driver
- Hardware random number generator core
- Clock framework and drivers
CVEs in this advisory 2
Updates
- Published by Ubuntu
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.