Ubuntu FIPS/Tegra Fixes CVE-2026-98432: Patch and Reboot

I saw Ubuntu notices USN-9027-2 and USN-9091-1, dated 13 Nov 2026, releasing patches for the FIPS and NVIDIA Tegra kernels, so I have collected them here for checking by flavor. Each kernel line uses different packages, so the update must match what is installed.

Which kernel lines receive patches this time

This table lists the versions from the USNs for comparison with packages of the same flavor. If the repository has a newer version, check the notices for that kernel line as well.

FIPS in this notice uses the FIPS Updates channel through Ubuntu Pro, while the linux-image-fips and linux-image-fips-5.15 metapackages use version 5.15.0.203.117. This version number differs from the image package version. Tegra has separate standard and RT metapackages, as listed in USN-9091-1.

The CVE-2026-98432 and CVE-2026-99999 pages still show FIPS on 22.04 and Tegra on 24.04 as “Vulnerable work in progress,” alongside the same version numbers as the USNs. The two sources still conflict. The table in this post uses the versions that the USNs dated 13 Nov 2026 identify as fixed. Check USN-9027-2 and USN-9091-1 against the CVE pages before updating.

The main vulnerabilities and the scores to distinguish

CVE-2026-98432 is a use-after-free during IPv4 TCP connection creation. If duplicate SYN packets arrive concurrently, the memory holding options may be freed while another part of the code is still reading it. Ubuntu states that this could lead to RCE and assigns it Critical priority.

The Ubuntu page gives it a CVSS 3.1 score of 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. According to this vector, an attacker can reach it over the network without an account or any user interaction. The CVSS 4.0 score is 9.2, where AT:P means additional attack conditions are required. The score does not guarantee that an attack will succeed on every machine. See the Ubuntu CVE page.

CVE-2026-99999 fixes validation of checksum_start. If a packet has invalid metadata, the checksum calculation code may corrupt the network header. The Ubuntu page shows a CVSS 3.1 score of 9.3, with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which specifies a Local attack.

Ubuntu assigns it Medium priority, while the CVSS 4.0 score is 6.9 and also specifies that the attacker needs low privileges. The two assessment versions use different conditions, so this should not be described as remote RCE like the first vulnerability. See the CVE-2026-99999 page.

CVE-2026-98432 and CVE-2026-99999 are not yet in CISA's KEV dated 10 Nov 2026, so that edition has no date added or KEV deadline for either vulnerability. Absence from KEV does not mean a vulnerability has never been exploited. The two Ubuntu notices cited here do not state that exploitation has occurred.

What else FIPS fixes, and why Tegra hardware matters

USN-9027-2 also lists CVE-2025-21656, CVE-2026-63940 and CVE-2026-74350 in addition to the two main vulnerabilities. The first concerns the drivetemp driver: when a SCSI error occurs, such as a disk disconnecting, the driver may send data from uninitialized memory to userspace. The Ubuntu CVE-2025-21656 page lists its priority as Medium.

CVE-2026-63940 fixes the handling of Port I/O requests with a zero length or count in KVM SEV to prevent underflow. Ubuntu assigns it Critical priority on the CVE-2026-63940 page, while Red Hat gives it a CVSS 3 score of 7.0 and a Moderate severity rating, differing from the cve.org score of 9.3 shown in the same table. The assessors give different scores. Check whether the system uses this functionality as well.

The Tegra notice covers vulnerabilities in several parts of the kernel. I have chosen to focus on the two IPv4 CVEs above. CVE-2023-20585 in the notice explicitly refers to AMD processors, IOMMU and SEV-SNP. Its inclusion in the notice does not mean every Tegra device is affected by the AMD issue. Check the CPU, kernel config and functionality in use as well.

For earlier context, see the Debian/Ubuntu patch roundup, Ubuntu kernels by flavor and NVIDIA/Tegra patches.

Check packages, update, then verify after reboot

Start by checking Ubuntu, the architecture, the kernel and the packages. The uname -r command shows the running kernel release, while dpkg-query shows the full versions of the installed packages.

cat /etc/os-release
uname -m
uname -r
dpkg-query -W -f='${binary:Package}\t${Version}\t${Status}\n' \
  'linux-image-*' 'linux-headers-*' 2>/dev/null
apt-mark showhold

1. Match the kernel line Check Ubuntu, the flavor, image and installed metapackage.
2. Prepare the maintenance window Check boot space, recovery access and external modules before changing the ABI.
3. Review the updates Simulate the upgrade and review the packages to be added and removed.
4. Install and reboot Verify the new kernel and device operation before closing the work.

For FIPS, also check the channel with pro status if the Ubuntu Pro client is installed. Update within the same kernel line, whether FIPS, standard Tegra or Tegra RT. Check the version available for installation with apt-cache policy linux-image-fips, or substitute the name of the metapackage actually installed. If the version listed in the USN is unavailable, check the repository and entitlement first.

sudo apt update
apt -s full-upgrade
# อ่านรายการเปลี่ยนแปลงก่อนดำเนินการในรอบบำรุงรักษา
sudo apt full-upgrade
# เมื่อการติดตั้งสำเร็จและพร้อมหยุดบริการ
sudo reboot

Both USNs warn of an ABI change. External kernel modules must be compiled and installed to match the new kernel. Check the headers and module build results before rebooting. If using DKMS, check dkms status as well. If modules were installed another way, follow the vendor's procedure. Installing a new image does not guarantee that network drivers or specialized devices will be ready to use.

After rebooting, check that the kernel matches the image package. The releases corresponding to the table are 5.15.0-203-fips, 6.8.0-1039-nvidia-tegra or 6.8.0-1039-nvidia-tegra-rt. If a newer version is installed, the value will change accordingly.

uname -r
dpkg-query -W -f='${binary:Package}\t${Version}\t${Status}\n' \
  "linux-image-$(uname -r)"
systemctl --failed
journalctl -b -k -p warning --no-pager

While waiting for patches, and checking for signs of compromise

The Ubuntu CVE page suggests a temporary mitigation for CVE-2026-98432 by filtering IPv4 TCP packets containing IP options, but states that it does not prevent all attacks. Before following Ubuntu's procedure, check whether the system needs IP options and which firewall tool it uses. Containers with separate networks also need separate rules. I recommend testing against the existing system before making the rules persistent across reboots.

If you find unusual behavior, preserve the kernel logs and incident timestamps for comparison with network logs as part of the incident response procedure. Confirming that a patched kernel is running does not tell you whether an intruder was present earlier.

How urgent I consider this

I treat machines accepting IPv4 TCP traffic from untrusted networks as urgent work. Schedule an update and reboot as soon as possible after testing passes. For FIPS and Tegra devices with specialized drivers, prepare recovery access and check modules first as well. After booting, check that the system is fully operational again. An apt command finishing without an error is not enough to close the work.

Sources: Ubuntu USN-9027-2, Ubuntu USN-9091-1, Ubuntu CVE-2026-98432, Ubuntu CVE-2026-99999, Ubuntu CVE-2025-21656, Ubuntu CVE-2026-63940, Red Hat CVE-2026-63940, CISA KEV data. Information current as of 13 Nov 2026; the KEV file I could check was the 10 Nov 2026 edition. I will return to update this later.