CVE coverage
Ubuntu 20.04 LTS CVE tracker
Noxen pulls Ubuntu 20.04 CVE data from OSV.dev's Ubuntu ecosystem feed. Focal is out of standard Canonical support since April 2025 — any new CVE fix lands in the Ubuntu Pro / ESM channel (Ubuntu:Pro:20.04:LTS), and Noxen surfaces those separately so you can see at a glance whether a host needs a Pro subscription to actually install the patch.
Live
Headline numbers
- Total CVE records (all distros)Loading…
- Last buildLoading…
- OSV records (Ubuntu + others)Loading…
- NVD records (cross-platform)Loading…
How matching works
What Noxen does for an Ubuntu 20.04 host
- Reads
/etc/os-releaseover SSH to confirm the host is on Ubuntu 20.04. - Reads the dpkg package list — every binary package, plus its corresponding source package via
dpkg-query --showformat='${Source}'. - Filters the local feed cache to OSV records tagged with ecosystem
Ubuntu:20.04:LTS. - For each record, compares your installed version against the OSV-published fix version using the Debian/Ubuntu version-comparison rules (epoch, upstream, debian-revision).
- Emits a finding only when the installed version is older than the fix. Where Ubuntu Pro / ESM-only fixes apply, they are flagged separately.
Live listings
Top recent critical CVEs (Ubuntu 20.04 / Ubuntu ecosystem)
Most-recently-published critical CVEs in the Ubuntu 20.04 / Ubuntu ecosystem. Auto-deduped to one row per CVE ID. Snapshot baked at ; live re-fetch on page load.
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| UBUNTU-CVE-2026-72287 | critical | — | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR i | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-74394 | critical | — | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without ov | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-64564 | critical | — | In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== c | linux | — | |
| UBUNTU-CVE-2026-64535 | critical | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch o | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-63940 | critical | — | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other c | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-53398 | critical | — | In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the de | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-53225 | critical | 9.1 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parame | linux | 3.13.0-215.266 | |
| UBUNTU-CVE-2026-53215 | critical | — | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver sti | linux-hwe-edge | — |
Top recent high-severity CVEs (Ubuntu 20.04 / Ubuntu ecosystem)
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| UBUNTU-CVE-2026-80725 | high | — | In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plai | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80696 | high | 7.8 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missin | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80631 | high | — | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80634 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80637 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. Th | linux | — | |
| UBUNTU-CVE-2026-80644 | high | — | In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUG_ON an invalid journal dinode [BUG] A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first | linux | — | |
| UBUNTU-CVE-2026-80665 | high | — | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80668 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in ma | linux-hwe-edge | — |
Notable
Recent CVEs Ubuntu 20.04 operators should know — ESM matters here.
- CVE-2024-6387 (regreSSHion) — OpenSSH signal-handler race producing pre-auth RCE.. Ubuntu advisory · Noxen deep-dive.
- CVE-2024-3094 (xz backdoor) — Supply-chain backdoor in xz-utils 5.6.0 / 5.6.1.. Ubuntu advisory · Noxen deep-dive.
- CVE-2024-1086 (nf_tables UAF) — Linux kernel privilege-escalation, observed in the wild.. Ubuntu advisory.
- CVE-2026-31431 (kernel algif_aead) — Local privilege escalation in the kernel's userspace AEAD interface.. Ubuntu advisory · Noxen deep-dive.
FAQ
Frequently asked about Ubuntu 20.04 CVEs
Is Ubuntu 20.04 still safe to run in 2026?
Safe in the sense that it still receives security patches — via Ubuntu Pro / ESM, free for up to 5 hosts. Standard support ended in April 2025 (5-year LTS window), so a 20.04 host without Pro enabled will not pick up new fixes. Noxen flags ESM-only remediations explicitly so you can see when a finding is gated on a Pro subscription.
How do I check Ubuntu 20.04 CVEs on a running host?
For a quick count: apt list --upgradable 2>/dev/null | grep -ci security. For a per-CVE breakdown with fix versions, Noxen reads dpkg over SSH and matches installed source-package versions against the OSV Ubuntu:20.04:LTS and Ubuntu:Pro:20.04:LTS ecosystem feeds. No agent on the target.
How long until 20.04 is truly EOL?
April 2030 with Ubuntu Pro / ESM — a 10-year window from initial release. That makes Focal one of the longest-supported Ubuntu LTS releases in the install base. The most common reason 20.04 hosts skip the 22.04 upgrade is that a regression in the latter would be more painful than just running ESM until 2030.
Does Noxen need Ubuntu Pro to scan 20.04 hosts?
No. The CVE feed Noxen consumes is publicly available regardless of Pro. What Pro provides is access to the actual fix packages via Canonical's ESM channels. Noxen will tell you the host needs Pro to install the patched version; the scan itself doesn't require a subscription.
Scan an Ubuntu 20.04 fleet with Noxen
Add your Ubuntu 20.04 hosts via your existing
~/.ssh/config; Noxen reads dpkg state and
matches against the live signed feed. No agent, no SaaS round-trip.
$79 one-time.