CVE coverage
Ubuntu 22.04 LTS CVE tracker
Noxen pulls Ubuntu 22.04 CVE data from OSV.dev's Ubuntu ecosystem feed — the same source Canonical itself publishes through their security tracker. Records are deduped against NVD/VulnCheck and shipped in a signed snapshot, daily. Pro/ESM-tagged fixes are kept distinct so you can see whether a patch requires a paid subscription before clicking through.
Live
Headline numbers
- Total CVE records (all distros)Loading…
- Last buildLoading…
- OSV records (Ubuntu + others)Loading…
- NVD records (cross-platform)Loading…
How matching works
What Noxen does for an Ubuntu 22.04 host
- Reads
/etc/os-releaseover SSH to confirm the host is on Ubuntu 22.04. - Reads the dpkg package list — every binary package, plus its corresponding source package via
dpkg-query --showformat='${Source}'. - Filters the local feed cache to OSV records tagged with ecosystem
Ubuntu:22.04:LTS. - For each record, compares your installed version against the OSV-published fix version using the Debian/Ubuntu version-comparison rules (epoch, upstream, debian-revision).
- Emits a finding only when the installed version is older than the fix. Where Ubuntu Pro / ESM-only fixes apply, they are flagged separately.
Live listings
Top recent critical CVEs (Ubuntu 22.04 / Ubuntu ecosystem)
Most-recently-published critical CVEs in the Ubuntu 22.04 / Ubuntu ecosystem. Auto-deduped to one row per CVE ID. Snapshot baked at ; live re-fetch on page load.
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| UBUNTU-CVE-2026-72287 | critical | — | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR i | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-74394 | critical | — | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without ov | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-64564 | critical | — | In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== c | linux | — | |
| UBUNTU-CVE-2026-64535 | critical | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch o | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-63940 | critical | — | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other c | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-53398 | critical | — | In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the de | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-53225 | critical | 9.1 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parame | linux | 3.13.0-215.266 | |
| UBUNTU-CVE-2026-53215 | critical | — | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver sti | linux-hwe-edge | — |
Top recent high-severity CVEs (Ubuntu 22.04 / Ubuntu ecosystem)
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| UBUNTU-CVE-2026-80725 | high | — | In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plai | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80696 | high | 7.8 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missin | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80631 | high | — | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80634 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80637 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get_unaligned_be32() and put_unaligned_be32() to safely read and write the timestamp fields. Th | linux | — | |
| UBUNTU-CVE-2026-80644 | high | — | In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUG_ON an invalid journal dinode [BUG] A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first | linux | — | |
| UBUNTU-CVE-2026-80665 | high | — | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns | linux-hwe-edge | — | |
| UBUNTU-CVE-2026-80668 | high | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in ma | linux-hwe-edge | — |
Notable
Recent CVEs Ubuntu 22.04 operators should know.
- CVE-2024-6387 (regreSSHion) — OpenSSH signal-handler race producing pre-auth RCE.. Ubuntu advisory · Noxen deep-dive.
- CVE-2024-3094 (xz backdoor) — Supply-chain backdoor in xz-utils 5.6.0 / 5.6.1.. Ubuntu advisory · Noxen deep-dive.
- CVE-2024-1086 (nf_tables UAF) — Linux kernel privilege-escalation, observed in the wild.. Ubuntu advisory.
- CVE-2026-31431 (kernel algif_aead) — Local privilege escalation in the kernel's userspace AEAD interface.. Ubuntu advisory · Noxen deep-dive.
FAQ
Frequently asked about Ubuntu 22.04 CVEs
How many CVEs affect Ubuntu 22.04 LTS?
Ubuntu 22.04 LTS (Jammy) sits inside the 2-million+ Ubuntu ecosystem feed Noxen consumes (OSV.dev + NVD). The 22.04 subset is filtered by ecosystem tag (Ubuntu:22.04:LTS) and rebuilt daily; live counts at the top of this page.
How do I check Ubuntu 22.04 CVEs on a running host?
For the immediate count: apt list --upgradable 2>/dev/null | grep -ci security. For a per-CVE breakdown with fix versions, Noxen reads dpkg over SSH and matches installed source-package versions against the OSV Ubuntu:22.04:LTS ecosystem feed. No agent on the target.
Is Ubuntu 22.04 still supported in 2026?
Yes. Ubuntu 22.04 LTS receives standard security updates from Canonical until April 2027 (5-year LTS window). Ubuntu Pro / ESM extends paid coverage through April 2032 — extended-window CVE fixes appear in the feed tagged Ubuntu:Pro:22.04:LTS. Many homelab and small-fleet operators are still on 22.04 because the 24.04 upgrade hasn't pulled them yet.
What's different between Ubuntu 22.04 and 24.04 CVE coverage?
Same data source (OSV.dev's Ubuntu ecosystem feed). Difference is the package versions and what's been backported. A CVE patched upstream in OpenSSH 9.8 gets a 22.04 backport into openssh-server 1:8.9p1-3ubuntu0.10+esm2 (note the +esm2 suffix indicating Pro/ESM channel) and a separate 24.04 backport into 1:9.6p1-3ubuntu13.3. Noxen matches against the right per-release fix version automatically.
Does Noxen need Ubuntu Pro to scan 22.04 hosts?
No. The CVE feed Noxen consumes is publicly available regardless of Pro. What Pro provides is access to the actual fix packages (via Canonical's ESM channels). Noxen will tell you the host needs Pro to install the patched version when the only available fix is ESM-gated; the scan itself doesn't require a subscription.
Scan an Ubuntu 22.04 fleet with Noxen
Add your Ubuntu 22.04 hosts via your existing
~/.ssh/config; Noxen reads dpkg state and
matches against the live signed feed. No agent, no SaaS round-trip.
$79 one-time.