From gregory.herrero at oracle.com  Tue Oct 13 00:41:49 2026
From: gregory.herrero at oracle.com (Oracle Ksplice)
Date: Tue, 13 Oct 2026 00:41:49 +0000
Subject: [Ksplice][Ubuntu-22.04-Updates] New Ksplice updates for Ubuntu
 22.04 Jammy (USN-8818-4)
Message-ID: <9ca05b9978f6cb3a66a7f94ed1f12196@ksplice.com>

Synopsis: USN-8818-4 can now be patched using Ksplice
CVEs: CVE-2026-53186 CVE-2026-53355 CVE-2026-53398 CVE-2026-63800 CVE-2026-63887 CVE-2026-63888 CVE-2026-63912 CVE-2026-63922 CVE-2026-63924 CVE-2026-63992 CVE-2026-63993 CVE-2026-63994 CVE-2026-64007

Systems running Ubuntu 22.04 Jammy can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-8818-4.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 22.04
Jammy install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2026-53186: Remote out-of-bounds memory access in InfiniBand SCSI RDMA driver.

* CVE-2026-53355: Use-after-free in Reliable Datagram Sockets Protocol driver.

* CVE-2026-53398: Remote use of uninitialized memory in NFSv4 server driver.

* CVE-2026-63800: Use-after-free in NFSv4.1 client driver.

* CVE-2026-63887: Buffer overrun in iSCSI Target Mode Stack driver.

* CVE-2026-63888: Out-of-bounds memory access in iSCSI Target Mode Stack driver.

* CVE-2026-63912: Memory corruption in XFRM ESP networking driver.

* CVE-2026-63922, CVE-2026-63924: Invalid pointer dereference in IPv6 networking stack.

* CVE-2026-63992: Out-of-bounds memory access in IP tunnel driver.

* CVE-2026-63993: Use-after-free in Virtual eXtensible Local Area Network (VXLAN) driver.

* CVE-2026-63994: Use-after-free in IP tunnel driver.

* CVE-2026-64007: Use-after-free in netfilter driver.

* Use-after-free in Netfilter driver.

* Note: Oracle has determined some CVEs are not applicable.

The kernel is not affected by the following CVEs
since the code under consideration is not compiled.

CVE-2025-10263, CVE-2026-53354


SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.