Ubuntu NVIDIA/Tegra Patches CVE-2026-93221; Update Promptly

I saw Ubuntu notices USN-9002-1 and USN-9003-1 dated 6 Nov. 2026, so I have brought the NVIDIA/Tegra kernel patches together here. I focus on NFS servers on Tegra; for Bluetooth, check whether it is enabled. These patches fix the specified kernel branches; they are not graphics driver patches that every Ubuntu machine needs.

New patches by kernel branch

This table lists the package versions that each USN identifies as fixed. The kernel branch names in the table are source package names; match both the release and the flavor. Each notice fixes a different set of CVEs, so this table cannot establish that NFS is fixed in every branch.

On Tegra, metapackages such as linux-image-nvidia-tegra and linux-image-nvidia-tegra-rt are version 6.8.0-1038.42, without the +2 found in the image package version. Check the package name together with its version. For generic or other cloud flavors, consult the USN for that branch (USN-9002-1, USN-9003-1).

You can also read the Ubuntu update roundup for 5 Nov. 2026. This post adds the patches dated 6 Nov. 2026.

NFS server: a race condition leading to a double-free

CVE-2026-93221 in USN-9002-1 affects nfsd4_end_grace(), which checks and sets the flag marking the end of the grace period separately. A background task and the RECLAIM_COMPLETE command can therefore both see that they need to proceed at the same time. With a tracking backend that clears the reclaim table, both tasks may clear the same entry twice, causing a double-free. A task reading this table concurrently may also read memory that has already been freed. The patch makes the flag check and set atomic (CVE record).

The CVE record lists CVSS 3.1 = 8.1 High with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, while Ubuntu assigns priority Critical, which uses a different set of criteria. An attacker can reach it over the network without privileges or user interaction, but the relevant grace/reclaim conditions must be present, and the attacker must win the race against the other task (NFS details, Score in the CVE record).

Check whether the machine is an NFS server using NFSv4 grace/reclaim and an affected tracking backend. Being only an NFS client is not enough to conclude that this bug affects it.

Bluetooth: a high score, but check the actual attack path

CVE-2026-89774 appears in both USNs and is a use-after-free in Bluetooth SCO. The sco_conn_ready() function may use a socket while another task is closing it. The patch adds reference holding and rechecks the state after locking.

Ubuntu lists 8.8 High and priority Medium, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attacker must be within Bluetooth range, rather than sending a web request from the internet. Ubuntu's score breakdown labels it CVSS v3.0, but the vector specifies 3.1. The CVE record also lists the score as 8.8 and this vector as CVSS 3.1, so I use the version from the CVE record (Bluetooth details, CVE record).

The Bluetooth patch status also differs between sources. Ubuntu's CVE page shows Tegra on 24.04, linux-nvidia-7.0 on 24.04, and linux-nvidia-bos on 26.04 as Vulnerable with work in progress messages, but the two USNs list the fixed versions shown in the table. I use the USN lists and also recommend checking the candidate in APT (Package status on the CVE page).

Prioritize machines with Bluetooth enabled, and check the devices and modules in use as well. Do not conclude that a machine is safe just because the bluetooth service is stopped.

io_uring, AMD SEV-SNP, and other entries

CVE-2026-81010 is still referenced in USN-9002-1, but its CVE record changed to REJECTED on 4 Nov. 2026. The record says only that the assigning authority rejected or withdrew this identifier, so the two sources still disagree. I have kept the identifier here to explain the USN entry while noting that it has been withdrawn (USN-9002-1, Status in the CVE record).

Ubuntu's CVE page explains that canceled io_uring/waitid work may run in a kworker instead of the originating task, while the USN says a local attacker could crash the machine or cause a DoS. These are all Ubuntu's descriptions, which still reference the withdrawn identifier (Ubuntu's io_uring details, USN-9002-1).

CVE-2023-20585 in USN-9003-1 concerns AMD SEV-SNP. The bug is in Reverse Map Table checks when the IOMMU accesses a host buffer. An attacker must already have privileges and control of the hypervisor. This bug may allow data in guest memory to be modified. Ubuntu assigns priority Low, explaining that CAP_SYS_ADMIN is required to configure VFIO passthrough and generate DMA that triggers IOMMU events on affected hardware (SEV-SNP details).

For this CVE, AMD says both the SEV firmware and the OS must be updated, and SNP guests must be shut down and restarted. Updating the kernel alone therefore does not complete AMD's procedure (AMD-SB-3016).

Both USNs include CVE-2026-92502, which fixes leftover xarray tags in ext4's data=journal mode. This bug may cause a warning when remounting read-only during a reboot. Other entries cover filesystems, networking, BPF, memory management, and several driver groups; consult the full list for your flavor (ext4 details).

Neither notice states that exploitation has occurred in the wild. None of the five identifiers discussed in this post appear in the 4 Nov. 2026 edition of KEV (catalogVersion: 2026.11.04), so that edition has no CISA addition dates or deadlines for these entries. I checked the JSON in CISA's official repository. Absence from KEV does not mean that exploitation has not occurred (CISA KEV JSON).

Update the correct branch, then reboot

Check the release, the running kernel, and the installed images. Rows that do not say installed do not count as installed.

cat /etc/os-release
uname -r
uname -v
dpkg-query -W -f='${Package}\t${Version}\t${db:Status-Status}\n' \
  'linux-image-*nvidia*'

Use apt-cache policy followed by the installed package name, and check whether the candidate is the fixed version or a newer version in the same branch. If the package is held or uses another repository, investigate why. Do not switch flavors just because the version number is higher.

1. Check scope Match the release, flavor, and services actually enabled.
2. Prepare to reboot Back up data and prepare a boot recovery method appropriate to the system.
3. Update Read the simulated changes first, then check external modules after installation.
4. Verify Reboot, check the running image, and test the existing services.

sudo apt update
sudo apt -s full-upgrade
# อ่านรายการเปลี่ยนแปลงก่อนทำขั้นถัดไป
sudo apt full-upgrade
if command -v dkms >/dev/null 2>&1; then dkms status; fi
# ตรวจว่าโมดูลที่จำเป็นพร้อมสำหรับ kernel ใหม่ก่อนรีบูต
sudo reboot

Both USNs warn that the ABI has changed, so external modules must be recompiled and reinstalled. Check DKMS or follow the module provider's procedure before rebooting. Resolve any errors first. The system can receive new kernel versions through normal updates as long as the metapackage for that branch remains installed (USN-9002-1, USN-9003-1, Ubuntu package management).

While waiting, restrict access to NFS and disable unnecessary Bluetooth. These temporarily reduce exposure; they are not workarounds that the USNs endorse as fixing the bugs.

Check after boot and look for unusual signs

uname -r
uname -v
dpkg-query -W -f='${Package}\t${Version}\n' "linux-image-$(uname -r)"
systemctl --failed
systemctl is-active nfs-server.service bluetooth.service
sudo journalctl -k -b --no-pager | grep -Ei 'nfsd|Bluetooth|SCO|io_uring|BUG:|Oops|double.free|use.after.free'

Check that the required services are running again. Test NFS from an authorized client and check the modules as well. You can read how to check versions in the article on kernel vulnerabilities added to KEV, but you must check each CVE's KEV status separately.

The sources I read provide no IOCs, such as IP addresses or hashes, for this set. Logs can help identify symptoms, but search results alone cannot establish whether a machine has been attacked or is safe. If the machine has crashed, examine the logs from the boot during which it happened and retain crash data for further investigation. If a compromise has already occurred, patching alone does not remove what the attacker left behind.

I treat Tegra machines running an NFS server as urgent work. Schedule the update and reboot for the earliest maintenance window. For Bluetooth, prioritize according to whether it is enabled. Other machines in these branches should still receive the patches because they also include fixes for other groups of bugs.

Sources: Ubuntu USN-9002-1, Ubuntu USN-9003-1, Ubuntu CVE-2026-93221, Ubuntu CVE-2026-89774, Ubuntu CVE-2026-81010, Ubuntu CVE-2023-20585, Ubuntu CVE-2026-92502, CVE-2026-81010 record with REJECTED status, AMD-SB-3016, CISA KEV JSON. I checked the sources on 7 Nov. 2026; both USNs are dated 6 Nov. 2026, and the KEV edition I checked is dated 4 Nov. 2026. I will come back and update this later.