USN-8761-1: Ubuntu Linux Kernel (Azure) Vulnerabilities — Detection, Hardening, and Patching Guide for Azure Workloads

---
title: Kernel Module Loaded From Suspicious Path
description: Detects insmod/modprobe execution loading a kernel module from a temporary, world-writable, or user-controlled directory — a hallmark of kernel LPE post-exploitation and rootkit staging on Linux hosts, including Azure VMs targeted with io_uring/Netfilter exploits.
references:
  - https://ubuntu.com/security/notices/USN-8761-1
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
id: 3f9c1a7e-8b2d-4e61-a5c3-7d0f9e2b4a81
status: experimental
date: 2026/01/14
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1547.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_tool:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/user/'
      - '/home/'
  condition: selection_tool and selection_path
falsepositives:
  - Legitimate out-of-tree driver builds in developer home directories
  - DKMS compilation workflows (typically execute under /usr/src or /var/lib/dkms)
level: high
---
title: Unprivileged User Namespace Creation Followed by Namespace Escalation Tools
description: Detects creation of user namespaces via unshare or container runtime tooling executed by non-service accounts — a common prerequisite step in Linux kernel LPE chains (io_uring, Netfilter/nftables) where the attacker needs CAP_SYS_ADMIN inside a namespace to reach vulnerable kernel code.
references:
  - https://ubuntu.com/security/notices/USN-8761-1
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
id: 8a2e4d61-1c5b-4f93-b7e2-9d3a6c0e5f27
status: experimental
date: 2026/01/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith: '/unshare'
  selection_flags:
    CommandLine|contains:
      - '--user'
      - '-U'
  selection_ns:
    CommandLine|contains:
      - '--map-root-user'
      - '--mount'
      - '--net'
      - '--pid'
  filter_service_accounts:
    User|startswith:
      - 'systemd-'
      - 'containerd'
  condition: selection_img and selection_flags and selection_ns and not filter_service_accounts
falsepositives:
  - Developers using rootless Podman/Docker (unshare is invoked under the hood)
  - bubblewrap-based sandboxing (Flatpak, some build systems)
level: medium
---
title: nftables Configuration Changed by Interactive or Non-Service Process
description: Detects nft rule manipulation originating from shells or unexpected parent processes rather than configuration management or the firewall service — consistent with attackers staging nftables-based kernel exploitation or disabling host firewall controls after privilege escalation on Linux systems patched under USN-8761-1.
references:
  - https://ubuntu.com/security/notices/USN-8761-1
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1562/004/
author: Security Arsenal
id: c47b9e05-2f8a-4d16-91ac-4b7e2d8f3c19
status: experimental
date: 2026/01/14
tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1562.004
  - attack.t1068
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/nft'
  filter_mgmt:
    ParentImage|endswith:
      - '/systemd'
      - '/nftables'
      - '/ansible-playbook'
      - '/sshd: '
  condition: selection and not filter_mgmt
falsepositives:
  - Administrators running nft interactively over SSH (tune filters to your change windows)
  - Kubernetes CNI plugins manipulating rules (filter by node pool and parent chain)
level: medium

// Hunt 1: Azure Ubuntu VMs running outdated linux-azure kernels
// Normalizes kernel versions reported via Syslog/Heartbeat to flag pre-patch builds.
// Update 'PatchedVersion' to the fixed kernel version from your Ubuntu release's USN-8761-1 entry.
let PatchedVersion = "REPLACE_WITH_FIXED_KERNEL_VERSION";  // e.g. "6.8.0-XXXX-azure"
Heartbeat
| where TimeGenerated > ago(7d)
| where OSType == "Linux"
| join kind=inner (
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has "Linux version" or ProcessName == "kernel"
    | summarize LastKernelMsg = arg_max(TimeGenerated, SyslogMessage) by Computer
) on Computer
| extend KernelVersion = extract(@"([0-9]+\.[0-9]+\.[0-9]+-[0-9]+-azure)", 1, LastKernelMsg)
| where isnotempty(KernelVersion) and KernelVersion != PatchedVersion
| summarize LastSeen = max(TimeGenerated), Kernel = any(KernelVersion) by Computer, ComputerIP
| project Computer, ComputerIP, Kernel, LastSeen
| sort by LastSeen desc;

// Hunt 2: Privilege escalation precursor behaviors on Linux (via Defender for Endpoint on Linux)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("unshare", "insmod", "modprobe", "nft")
| extend SuspiciousPath = ProcessCommandLine has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "/run/user/")
| where FileName =~ "unshare"
     or (FileName in~ ("insmod", "modprobe") and SuspiciousPath)
     or (FileName =~ "nft" and InitiatingProcessFileName !in~ ("systemd", "ansible-playbook", "sshd"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc;

// Hunt 3: New local privilege escalation indicators — unexpected setuid binaries or credential access
// after a suspicious namespace/module event (correlation within 30 minutes on the same host)
let SuspiciousEscalation =
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName =~ "unshare" and ProcessCommandLine has "--map-root-user"
| summarize FirstSeen = min(TimeGenerated) by DeviceName, AccountName;
SuspiciousEscalation
| join kind=inner (
    DeviceProcessEvents
    | where FileName in~ ("chmod", "chown") and ProcessCommandLine has_any ("u+s", "4755", "777")
) on DeviceName
| where TimeGenerated between (FirstSeen .. datetime_add('minute', 30, FirstSeen))
| project DeviceName, AccountName, FirstSeen, TimeGenerated, FileName, ProcessCommandLine

-- Hunt: Linux kernel version + module inventory for USN-8761-1 posture assessment
-- Deploy fleet-wide via Velociraptor hunt; review hosts with modules loading outside standard paths.
LET uname = SELECT Stdout FROM execve(argv=['/bin/uname', '-r'])
LET kernel_version = SELECT split(string=Stdout, sep='\n')[0] AS Kernel FROM uname

LET modules = SELECT parse_string_with_regex(
        string=Line,
        regex='^(?P<Name>[^ ]+)\s+(?P<Size>[0-9]+)').g AS Mod
    FROM parse_file(filename='/proc/modules', accessor='data')
    WHERE Mod

SELECT kernel_version[0].Kernel AS RunningKernel,
       Mod.Name AS ModuleName,
       Mod.Size AS ModuleSize
FROM modules
-- Optional: join with file existence check for on-disk .ko provenance
-- Modules with no backing file in /lib/modules/<kernel>/ or /usr/lib/modules/ deserve review

-- Hunt: Processes with open io_uring file descriptors or anon inode usage consistent with
-- io_uring abuse, plus processes executing from deleted/memfd-backed binaries (common LPE PoC pattern)
SELECT Pid, Name, Exe, Cmdline, Username
FROM pslist()
WHERE Exe =~ '(deleted)'                       -- deleted binary still executing (memfd/overwrite trick)
   OR Cmdline =~ '/dev/shm/|/var/tmp/'         -- execution from world-writable staging dirs
   OR Name =~ 'io_uring'                       -- io_uring worker threads spawned by a process

#!/usr/bin/env bash
# USN-8761-1 — Ubuntu Azure kernel patching and verification script
# Run on each affected Ubuntu VM (or via Azure Run Command / Ansible at scale).
# Requires sudo. Reboots are REQUIRED — kernel patches do not take effect otherwise.

set -euo pipefail

echo "=== [1] Current kernel and release ==="
uname -r
. /etc/os-release && echo "Ubuntu ${VERSION_ID} (${VERSION_CODENAME})"

# Confirm this host is actually running the Azure kernel flavor
if ! uname -r | grep -q "azure"; then
    echo "[!] Not running the linux-azure kernel flavor. Check USN-8761-1 applicability"
    echo "    for your kernel (linux-generic / linux-aws / linux-gcp have separate USNs)."
fi

echo "=== [2] Refresh package metadata and apply updates ==="
export DEBIAN_FRONTEND=noninteractive
apt-get update
# Targeted: upgrade only the Azure kernel metapackage + headers first
apt-get install -y --only-upgrade linux-azure linux-image-azure linux-headers-azure || \
    apt-get install -y --only-upgrade linux-image-$(uname -r)
# Full security sweep (recommended): catches userspace fixes shipped in the same cycle
apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade

echo "=== [3] Compare installed vs running kernel ==="
RUNNING="$(uname -r)"
INSTALLED="$(dpkg-query -W -f='${Version}\n' linux-image-azure 2>/dev/null || echo 'n/a')"
LATEST_IMG="$(ls -1 /boot/vmlinuz-*-azure 2>/dev/null | sort -V | tail -n1)"
echo "Running : ${RUNNING}"
echo "Installed metapackage: ${INSTALLED}"
echo "Newest image on disk : ${LATEST_IMG}"

if [[ -n "${LATEST_IMG}" && "/boot/vmlinuz-${RUNNING}" != "${LATEST_IMG}" ]]; then
    echo "[!] REBOOT REQUIRED — running kernel does not match newest installed image."
    touch /var/run/reboot-required
else
    echo "[OK] Running kernel matches latest installed image."
fi

echo "=== [4] Hardening: restrict unprivileged user namespaces (LPE blast-radius reduction) ==="
# Mitigates a large class of kernel LPEs (io_uring, netfilter, fs) that require
# CAP_SYS_ADMIN inside a user namespace. Validate compatibility with rootless
# containers / bubblewrap / Chrome sandboxing on the host before enforcing.
cat >/etc/sysctl.d/90-usn-8761-1-hardening.conf <<'EOF'
kernel.unprivileged_userns_clone = 0
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.yama.ptrace_scope = 1
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
EOF
sysctl --system

echo "=== [5] Optional: disable io_uring where not required ==="
# io_uring is a historically productive LPE surface. If no workload on the host
# needs it (most web/app/database workloads do not), consider disabling via sysctl:
#   echo 'kernel.io_uring_disabled = 2' >> /etc/sysctl.d/90-usn-8761-1-hardening.conf
# NOTE: test first — some modern runtimes (e.g., certain Java/Node versions,
# some databases) will fall back gracefully, but confirm before production rollout.

echo "=== [6] Ubuntu Pro / esm status ==="
pro security-status 2>/dev/null || echo "Ubuntu Pro not attached — consider attaching for expanded patching coverage."

echo "=== Done. Schedule reboot if flagged above. Verify post-reboot: uname -r ==="