USN-9025-1: Ubuntu Linux Kernel Security Update — SEV-SNP Guest Integrity Risk, Detection and Remediation Guide

Canonical has published USN-9025-1, a Linux kernel security update for Ubuntu that corrects a broad set of flaws spanning nearly a dozen kernel subsystems — USB Gadget drivers, memory management, NVDIMM drivers, the network file systems library, the Handshake API, the networking core, the stream parser, and the ARM32, ARM64, M68K, MIPS, and OpenRISC architecture ports. The notice also carries a fix for CVE-2023-20585, an AMD processor issue in which Reverse Map Table (RMP) checks are not properly performed when the IOMMU accesses certain host buffers — allowing a local attacker with hypervisor access to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory.

Two things should drive urgency here. First, the breadth of the subsystem list is a signal in itself: cumulative kernel updates touching memory management, the networking core, and architecture-specific code historically include privilege-escalation and memory-corruption fixes that attackers chain with initial-access footholds. Second, the SEV-SNP issue cuts directly at the trust model of confidential computing. If you are running AMD EPYC-based virtualization with SEV-SNP guests — increasingly common in multi-tenant cloud and regulated-industry deployments — a malicious or compromised hypervisor operator could violate the guest memory integrity guarantees you are paying for.

Although CVE-2023-20585 was originally disclosed in 2023, its inclusion in a current kernel update in 2026 means unpatched Ubuntu systems are still exposed today. The defensive lesson is not the age of the CVE — it is the gap between disclosure and your last kernel patch cycle. If your fleet is behind on kernel updates, this notice is your forcing function.

Technical Analysis

Affected components

Per the Ubuntu Security Notice, the update corrects flaws in:

• USB Gadget drivers — the subsystem that lets a Linux device act as a USB peripheral (commonly enabled via libcomposite and g_* modules). Flaws here have historically enabled local privilege escalation and, in gadget-enabled devices, attack surface exposed over the USB port itself.
• Memory management (mm) — the highest-risk category in any kernel update; mm bugs routinely translate into arbitrary code execution or privilege escalation.
• NVDIMM drivers — persistent memory device handling; relevant to HPC and database workloads using NVDIMM/PMEM.
• Network file systems library — shared code underpinning NFS and related filesystems; attack surface reachable by untrusted file content or network-facing services.
• Handshake API — kernel-level handshake handling used by TLS offload and in-kernel consumers.
• Networking core and stream parser — remotely reachable code paths depending on configuration.
• ARM32, ARM64, M68K, MIPS, OpenRISC architecture code — relevant to embedded, IoT, and ARM-based cloud instances (e.g., ARM64 Ubuntu images).

CVE-2023-20585 — AMD SEV-SNP RMP check failure

AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) is designed to protect guest VM memory from a malicious hypervisor. The Reverse Map Table (RMP) is the hardware-enforced data structure that tracks page ownership and enforces that isolation. This flaw arises because some AMD processors did not properly perform RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor-level access can abuse this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory — precisely the guarantee SEV-SNP exists to provide.

Key exploitation characteristics from a defender's perspective:

• Attack vector: Local. The attacker needs hypervisor/host-level access — this is not remotely exploitable from the network.
• Threat model: Malicious cloud tenant who has escaped to the host, a compromised hypervisor, or a rogue privileged insider in a hosting environment.
• Impact: Integrity violation of confidential guest memory. In a confidential-computing deployment, this undermines attestation-driven trust decisions made downstream.

CVSS and exploitation status

The Ubuntu notice does not enumerate per-CVE CVSS scores in the summary text, and no CVEs other than CVE-2023-20585 are named. At the time of writing, CVE-2023-20585 is not listed in the CISA Known Exploited Vulnerabilities catalog and there is no confirmed in-the-wild exploitation campaign. That said, kernel privilege-escalation primitives are among the most reliably weaponized classes of vulnerabilities once public; the correct posture is to treat the entire update as patch-now, not patch-later. Verify applicability for your specific Ubuntu release and kernel flavor against the official notice, since USN kernel updates are published per-release and per-kernel-variant (generic, lowlatency, AWS, Azure, GCP, etc.).

Detection & Response

Kernel patching is primarily a preventive control, but there are meaningful detection opportunities — both for pre-patch exploitation attempts and for validating post-patch posture. The highest-fidelity behavioral signal tied to this notice is the loading of USB Gadget modules (libcomposite, g_mass_storage, g_ether, g_serial, etc.), which is rare on servers and cloud instances and directly maps to one of the patched subsystems. Unexpected module loads from non-standard paths are a second strong signal for kernel-level post-exploitation activity.

Sigma rules

---
title: Linux USB Gadget Kernel Module Loaded
description: Detects loading of USB Gadget subsystem kernel modules (libcomposite, g_* modules), which is uncommon on servers and maps to a subsystem patched in USN-9025-1. Gadget modules can also be abused for device emulation attacks.
references:
  - https://ubuntu.com/security/notices/USN-9025-1
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall:
      - 'init_module'
      - 'finit_module'
    exe|endswith:
      - '/modprobe'
      - '/insmod'
      - '/kmod'
  keywords:
    - 'libcomposite'
    - 'g_mass_storage'
    - 'g_ether'
    - 'g_serial'
    - 'g_multi'
    - 'g_hid'
    - 'usb_f_'
    - 'configfs'
  condition: selection and keywords
falsepositives:
  - OTG-capable embedded devices and developer boards legitimately using gadget mode
  - Kernel CI/build infrastructure
level: medium
---
title: Kernel Module Loaded From Non-Standard Path
description: Detects insmod/modprobe loading a kernel module from a path outside standard module directories, consistent with rootkit or kernel post-exploitation activity following privilege escalation via a kernel flaw.
references:
  - https://ubuntu.com/security/notices/USN-9025-1
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/user/'
      - '/home/'
  condition: all of selection_*
falsepositives:
  - Out-of-tree driver installation by administrators (e.g., DKMS builds) — tune per environment
level: high
---
title: KVM Hypervisor Process Abnormal Termination
description: Detects repeated crashes of QEMU/KVM hypervisor processes, which may indicate attempts to trigger memory corruption in virtualization-adjacent code paths such as the SEV-SNP RMP/IOMMU handling patched in USN-9025-1.
references:
  - https://ubuntu.com/security/notices/USN-9025-1
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'ANOM_ABEND'
    exe|contains:
      - 'qemu-system'
      - 'qemu-kvm'
      - 'kvm'
falsepositives:
  - Misbehaving guest workloads causing legitimate QEMU crashes — investigate frequency and guest context
level: medium

Microsoft Sentinel / Defender KQL

For fleets forwarding Linux syslog and audit data into Sentinel, this query hunts for kernel oops/panic messages, USB gadget module loads, and module loads from suspicious paths — the observable residue of kernel exploitation attempts and gadget attack surface activation.

// Hunt kernel exploitation indicators: oops/panic, gadget modules, out-of-tree module loads
let GadgetModules = dynamic(["libcomposite", "g_mass_storage", "g_ether", "g_serial", "g_multi", "g_hid", "usb_f_"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any ("kernel: BUG", "kernel: Oops", "general protection fault", "RMP", "SEV-SNP", "sev_guest")
        or (SyslogMessage has_any (GadgetModules) and SyslogMessage has "module")
    | project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage),
    (SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4688
    | where CommandLine has_any ("insmod", "modprobe")
        and CommandLine has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "/run/user/")
    | project TimeGenerated, Computer, CommandLine, ParentProcessName, Account)
| sort by TimeGenerated desc

A second query for trend-spotting on hypervisor hosts — a spike in KVM/QEMU crash events on AMD EPYC SEV-SNP hosts should be investigated as a potential integrity-probing attempt:

// Detect spikes in QEMU/KVM crash signatures on hypervisor hosts
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("qemu", "kvm") and SyslogMessage has_any ("segfault", "traps", "BUG", "Oops")
| summarize CrashCount = count(), SampleMessages = make_set(SyslogMessage, 5) by Computer, bin(TimeGenerated, 1h)
| where CrashCount > 3
| sort by TimeGenerated desc

Velociraptor VQL

Use this hunt artifact across your Ubuntu estate to simultaneously (a) inventory running kernel versions for patch-gap analysis and (b) surface loaded USB gadget modules and out-of-tree modules that warrant review.

-- USN-9025-1 posture hunt: kernel version, gadget modules, out-of-tree modules
LET kernel = SELECT * FROM execve(argv=['uname', '-r'])
LET modules = SELECT Name, Size, UsedBy
  FROM parse_file(filename='/proc/modules', accessor='data',
                  query='SELECT * FROM split_records(...)')
SELECT { SELECT * FROM scope() } AS Scope,
       read_file(filename='/proc/sys/kernel/osrelease') AS KernelVersion,
       parse_lines(filename='/proc/modules') AS LoadedModules
FROM scope()

A more operationally practical version that flags the specific indicators:

-- Flag gadget modules and modules not backed by /lib/modules
SELECT read_file(filename='/proc/sys/kernel/osrelease') AS KernelRelease,
       FullPath, Module
FROM foreach(row=parse_lines(filename='/proc/modules'),
  query={
     SELECT split(string=Line, sep=' ')[0] AS Module,
            '/proc/modules' AS FullPath
     FROM scope()
  })
WHERE Module =~ '^(libcomposite|g_mass_storage|g_ether|g_serial|g_multi|g_hid|usb_f_)'

Analyst note: Filter results against your known-good baseline. OTG-enabled embedded devices legitimately load gadget modules; servers and cloud VMs almost never should. Any gadget module on a production server is an investigation, not a false positive.

Remediation

Patch

Apply the updated kernel packages for your specific Ubuntu release and kernel flavor, then reboot into the new kernel — kernel updates do not take effect until reboot. Verify release-specific fixed package versions against the official notice: https://ubuntu.com/security/notices/USN-9025-1. Canonical publishes per-release and per-flavor (generic, lowlatency, aws, azure, gcp, oracle, kvm) fixed versions; confirm yours before declaring systems remediated.

The following Bash script audits current state, applies the update, and verifies post-reboot posture. Run it via your configuration management or manually on prioritized systems.

#!/usr/bin/env bash
# USN-9025-1 remediation and verification script (Ubuntu)
set -euo pipefail

echo "=== Current kernel ==="
uname -r
echo "=== Ubuntu release ==="
lsb_release -ds

echo "=== Pending kernel updates ==="
apt-get update -qq
apt list --upgradable 2>/dev/null | grep -Ei 'linux-image|linux-headers|linux-modules' || echo "No kernel updates pending"

echo "=== Applying kernel and security updates ==="
DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade \
  "linux-image-$(uname -r)" 2>/dev/null || true
DEBIAN_FRONTEND=noninteractive apt-get dist-upgrade -y

echo "=== USN-9025-1 / CVE-2023-20585 changelog check ==="
# Verify the installed kernel changelog references the fix
KERNEL_PKG="linux-image-$(uname -r)"
if zcat /usr/share/doc/linux-image-*/changelog.Debian.gz 2>/dev/null | grep -qi "20585"; then
  echo "[PASS] CVE-2023-20585 fix present in installed kernel changelog"
else
  echo "[WARN] CVE-2023-20585 not found in changelog — verify fixed version at https://ubuntu.com/security/notices/USN-9025-1"
fi

echo "=== Reboot requirement ==="
if [ -f /var/run/reboot-required ]; then
  cat /var/run/reboot-required.pkgs 2>/dev/null || true
  echo "[ACTION REQUIRED] Reboot to load the patched kernel"
else
  echo "No reboot flag set"
fi

echo "=== Post-patch audit: gadget modules that should not be present on servers ==="
lsmod | grep -E '^(libcomposite|g_mass_storage|g_ether|g_serial|g_multi|g_hid|usb_f_)' \
  && echo "[WARN] USB gadget modules loaded — investigate" \
  || echo "[PASS] No USB gadget modules loaded"

echo "=== SEV-SNP host check (AMD confidential computing systems) ==="
if [ -d /sys/module/kvm_amd ]; then
  grep -H . /sys/module/kvm_amd/parameters/sev_snp 2>/dev/null || true
  dmesg | grep -iE 'SEV|SNP|RMP' | tail -20 || true
fi

Prioritization guidance

1. First: AMD EPYC hypervisors running SEV-SNP guests. The guest-memory-integrity impact of CVE-2023-20585 is the most consequential named issue. Coordinate with your confidential-computing attestation tooling — guests should re-attest against patched hosts.
2. Second: internet-facing and multi-tenant systems. Networking core, stream parser, and network filesystem fixes are the most remotely relevant components.
3. Third: general server and workstation fleet, including ARM64 instances (Ubuntu ARM images are explicitly in scope of this update).

Additional hardening

• Reduce the attack surface this notice patches: if servers do not need USB gadget functionality, blacklist the modules: add blacklist libcomposite and the g_* modules to /etc/modprobe.d/blacklist-usbgadget.conf.
• Enable unattended security upgrades (unattended-upgrades) for the security pocket if your change window allows, and pair it with a reboot orchestration strategy (kexec/livepatch where licensed — note Ubuntu Livepatch covers many, but not all, kernel CVEs; verify coverage for USN-9025-1 rather than assuming it).
• Enroll hosts in Ubuntu Pro / security-status tooling so ubuntu-security-status reports outstanding USNs per host — this closes the measurement gap that lets 2023-era fixes sit unapplied into 2026.
• Hypervisor access governance: CVE-2023-20585 requires hypervisor-level access. Tighten and monitor who and what can reach the host: restrict SSH, enforce MFA and JIT access, and forward host audit logs off-box so a compromised host cannot erase evidence of guest-memory tampering attempts.

Bottom line

USN-9025-1 is a routine-looking cumulative kernel update with a non-routine payload: a fix that restores the memory-integrity guarantee of AMD SEV-SNP confidential computing. If your patch cadence allowed a 2023-disclosed CPU issue to remain open into 2026, treat this as a process failure worth correcting, not just a package to install. Patch, reboot, verify the changelog, baseline your gadget-module posture, and close the loop with asset-level USN reporting.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub