USN-9038-1: GStreamer Good Plugins, GStreamer Base Plugins vulnerabilities
USN-9038-1
Summary
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263) Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture
- User-space API (UAPI)
- Kernel build system
- ARM32 architecture
- PowerPC architecture
- RISC-V architecture
- S390 architecture
- User-Mode Linux (UML)
- x86 architecture
- Cryptographic API
- Intel NPU Driver
- Compute Acceleration Framework
- ACPI drivers
- Drivers core
- DRBD Distributed Replicated Block Device drivers
- Rados block device (RBD) driver
- Ublk userspace block driver
- Compressed RAM block device driver
- Bluetooth drivers
- Hardware crypto device drivers
- CXL (Compute Express Link) drivers
- Arm Firmware Framework for ARMv8-A(FFA)
- EFI core
- FPGA Framework
- GPU drivers
- HID subsystem
- Hardware monitoring drivers
- I2C subsystem
- I3C subsystem
- InfiniBand drivers
- Input Device core drivers
- Input Device (Mouse) drivers
- IOMMU subsystem
- Multiple devices driver
- Media drivers
- Fastrpc Driver
- Network drivers
- Mellanox network drivers
- Microsoft Azure Network Adapter (MANA) driver
- MediaTek network drivers
- NVME drivers
- Operating Performance Points (OPP) driver
- PCI subsystem
- PTP clock framework
- RPMSG subsystem
- SCSI subsystem
- SoundWire subsystem
- SPI subsystem
- Greybus lights staging drivers
- Media staging drivers
- NVIDIA Tegra embedded controller (NVEC) staging driver
- Realtek RTL8723BS SDIO drivers
- TCM subsystem
- Trusted Execution Environment drivers
- Thunderbolt and USB4 drivers
- TTY drivers
- USB Gadget drivers
- USB Dual Role (OTG-ready) Controller drivers
- USB Serial drivers
- vDPA drivers
- VFIO drivers
- Virtio Host (VHOST) subsystem
- Virtio drivers
- Xen hypervisor drivers
- 9P distributed file system
- AFS file system
- File systems infrastructure
- BTRFS file system
- Ceph distributed file system
- exFAT file system
- F2FS file system
- GFS2 file
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
This update corrects flaws in the following subsystems:
- ARM64 architecture
- User-space API (UAPI)
- Kernel build system
- ARM32 architecture
- PowerPC architecture
- RISC-V architecture
- S390 architecture
- User-Mode Linux (UML)
- x86 architecture
- Cryptographic API
- Intel NPU Driver
- Compute Acceleration Framework
- ACPI drivers
- Drivers core
- DRBD Distributed Replicated Block Device drivers
- Rados block device (RBD) driver
- Ublk userspace block driver
- Compressed RAM block device driver
- Bluetooth drivers
- Hardware crypto device drivers
- CXL (Compute Express Link) drivers
- Arm Firmware Framework for ARMv8-A(FFA)
- EFI core
- FPGA Framework
- GPU drivers
- HID subsystem
- Hardware monitoring drivers
- I2C subsystem
- I3C subsystem
- InfiniBand
CVEs in this advisory 1
Updates
- Published by Ubuntu
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.