Ubuntu Realtime Kernel Critical Update: Addressing SMB Vulnerabilities CVE-2025-22037 & CVE-2025-37899

 

Get the latest intelligence on the critical Ubuntu Linux kernel update USN-8059-4. This deep-dive analyzes the SMB vulnerabilities CVE-2025-22037 and CVE-2025-37899 impacting Ubuntu 22.04 & 24.04 LTS Realtime kernels. Learn about the technical risks, the ABI change impact on third-party modules, and a step-by-step guide to patching your real-time systems to maintain enterprise-grade security and compliance.

On February 25, 2026, Canonical released a critical security notice (USN-8059-4) addressing severe vulnerabilities in the Linux kernel for Ubuntu’s real-time environments. 

For organizations leveraging Ubuntu 22.04 LTS and 24.04 LTS for latency-sensitive operations, understanding the nuances of this patch is not just an IT task—it's a mission-critical imperative. 

This advisory dissects the technical details, potential business impact, and the precise remediation steps required to secure your infrastructure against active threats targeting the SMB protocol.

The Core Threat: Why USN-8059-4 Demands Immediate Action

This update is not a routine maintenance release; it directly patches two significant vulnerabilities (CVEs) within the Server Message Block (SMB) network file system subsystem of the Linux kernel. SMB is the lifeblood of file sharing in mixed-environment networks, particularly those interfacing with Windows systems or network-attached storage (NAS). A compromise here can lead to a full system takeover.

• Targeted Systems: Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.

• Affected Components: The linux-realtime and linux-realtime-6.8 kernels, designed for deterministic processing in industrial control, financial trading, and telecommunications.

• The Vulnerabilities:

  • CVE-2025-22037: A critical flaw in the SMB client that could allow a malicious server to execute arbitrary code on the connecting machine.

  • CVE-2025-37899: A severe vulnerability in the SMB2 protocol handling that could lead to a system crash (denial of service) or potential privilege escalation, enabling an attacker to compromise the entire system.

An attacker exploiting these flaws could pivot from a single compromised workstation to critical servers, disrupting operations and exfiltrating sensitive data. For real-time systems where downtime equates to direct financial loss, the stakes are exceptionally high.

Technical Deep Dive: Beyond the CVE Identifiers

While the CVE identifiers mark the destination, the technical path explains the journey. These vulnerabilities reside in how the kernel parses network traffic. Specifically, they involve improper validation of SMB message attributes. 

This is a classic example of how seemingly minor oversights in protocol implementation can cascade into critical security gaps.

Expert Insight: "The recurrence of vulnerabilities in the SMB stack highlights the inherent complexity of maintaining legacy protocol compatibility within modern, high-performance kernels. For real-time systems, the challenge is amplified as the need for low-latency processing often conflicts with the overhead of deep packet inspection." – A excerpt from a recent industry analysis on kernel security trends.

This update from Canonical addresses these specific parsing errors, effectively closing the door on these attack vectors.

The Critical ABI Change: A Mandatory Alert for Developers and SysAdmins

A crucial, non-negotiable element of this update is the Application Binary Interface (ABI) change.

ATTENTION: Due to an unavoidable ABI change, the kernel update introduces a new version number. This has a direct and significant consequence: you must recompile and reinstall all third-party kernel modules.

This is a common point of failure in update processes. Out-of-tree modules—such as proprietary drivers for specialized hardware (GPUs, network cards, storage controllers) or custom security modules—will be incompatible with the new kernel until they are rebuilt. 

Failing to do so will result in system instability or complete failure of those hardware components or software features.

To successfully complete this update, verify that you have the source code and build environment ready for all your third-party modules before proceeding.

Step-by-Step Remediation: Securing Your Ubuntu Realtime Kernel

To neutralize the threats posed by CVE-2025-22037 and CVE-2025-37899, follow these precise instructions. A system reboot is mandatory for the changes to take effect.

For Ubuntu 24.04 LTS Systems:

Update to the following kernel version (available with Ubuntu Pro):

• linux-image-6.8.1-1042-realtime (6.8.1-1042.43)

• Associated metapackages: linux-image-intel-iot-realtime, linux-image-realtime, linux-image-realtime-6.8.1

For Ubuntu 22.04 LTS Systems:

Update to the following kernel version (available with Ubuntu Pro):

• linux-image-6.8.1-1042-realtime (6.8.1-1042.43~22.04.1)

• Associated metapackages: linux-image-realtime-6.8.1, linux-image-realtime-hwe-22.04

Standard Update Procedure:

bash

sudo apt update
sudo apt upgrade
sudo reboot

Frequently Asked Questions (FAQ)

Q: What is Ubuntu Pro, and why is it required for these updates?

A: Ubuntu Pro is Canonical's expanded security maintenance subscription. It provides critical kernel livepatch services and broader security coverage for a vast array of packages beyond the main OS, including the real-time kernel variants. For organizations requiring compliance and production-grade stability, Ubuntu Pro is an essential investment.

Q: My system uses the standard generic kernel. Am I affected?

A: This specific notice (USN-8059-4) is for the linux-realtime kernel variants. However, the underlying vulnerabilities (CVE-2025-22037, CVE-2025-37899) may exist in other kernel flavors. It is imperative to check for corresponding Ubuntu Security Notices (like USN-8059-1, -2, -3) for your specific kernel type (e.g., linux-generic, linux-aws) and apply those updates immediately.

Q: How can I verify that the update was successful?

A: After rebooting, run the command uname -r. The output should display the new kernel version: 6.8.1-1042-realtime (or the 22.04 variant). You can also check your installed package versions with apt list --installed | grep linux-image-realtime.

Conclusion: Maintaining Trust in Your Real-Time Infrastructure

The discovery of CVE-2025-22037 and CVE-2025-37899 serves as a potent reminder of the dynamic nature of cybersecurity threats, especially within the complex Linux kernel. 

By applying USN-8059-4, you are not just patching code; you are reinforcing the integrity and reliability of your most critical, latency-sensitive operations.

Your Next Step: 

Do not delay. Audit your systems for the affected Ubuntu LTS releases with real-time kernels. Stage the update in a development environment to handle the third-party module recompilation, then deploy to production. 

Proactive patch management is the cornerstone of a resilient security posture.