Ubuntu USN-8911-1 fixes 29 CVEs in the 24.04 OEM kernel; reboot and module rebuild needed
Victoria Shinder2 min readCanonical published USN-8911-1 on 9 October, a kernel security update for the OEM kernel on Ubuntu 24.04 LTS (noble). It covers 29 CVEs. The OEM kernel is the variant Ubuntu ships on certified laptops and desktops from hardware partners to support newer hardware than the standard 24.04 kernel; machines on the generic kernel are not covered by this notice.
What is fixed. The notice does not detail each flaw. It states that several security issues were discovered and that an attacker could possibly use them to compromise the system, and it lists the affected areas:
- hardware crypto device drivers;
- the NVIDIA Tegra memory controller driver;
- network drivers;
- USB core drivers.
The CVE identifiers are listed on the notice page; Ubuntu does not assign them a single severity there, and each CVE page carries its own priority rating.
Fixed version. The source package linux-oem-6.17 moves to 6.17.0-1033.33, with the matching meta packages such as linux-headers-oem-24.04, -24.04a and -24.04b at the same version.
Two operational points the notice spells out:
- A reboot is required. Installing the package does not change the running kernel; the fixes only apply after restarting into the new one.
- The ABI changed, so the kernel was given a new version number. Any third-party kernel modules — out-of-tree drivers installed by hand, rather than through DKMS packages that rebuild automatically — must be recompiled and reinstalled. Systems that kept the standard kernel metapackages installed will pull the new kernel in with a normal upgrade; systems where those metapackages were removed will not.
What to do. On an affected machine: sudo apt update && sudo apt full-upgrade, confirm that a 6.17.0-1033 kernel is installed, rebuild any hand-installed modules, and reboot. uname -r after the restart shows whether the new kernel is running. Fleets that pin kernels should schedule the reboot rather than leave the patched kernel installed but inactive — in that state the machine reports the update as applied while still running the vulnerable code.
Source: Ubuntu Security Notice USN-8911-1 — https://ubuntu.com/security/notices/USN-8911-1