Ubuntu Kernel Security Updates: What Home Server Users Need to Do

What happened

Canonical published a large group of Linux kernel security notices on 20 and 21 August 2026. The affected packages include general Ubuntu 26.04 and 24.04 kernels, Ubuntu 24.04 Raspberry Pi kernels and Ubuntu 24.04 NVIDIA kernel flavours.

The dates matter: the general and Raspberry Pi notices were published on 20 August, while the NVIDIA-specific notice was published on 21 August. Treat them as one maintenance prompt, but use the notice that matches the kernel packages installed on each host.

This is relevant to home servers because installing a new kernel package does not change the kernel currently running in memory. Most systems need a controlled reboot before the patched kernel is active.

Who should check now

Check the host if it runs:

• Ubuntu Server 26.04 LTS
• Ubuntu Server 24.04 LTS, including HWE kernels
• Ubuntu 24.04 on a Raspberry Pi
• an Ubuntu 24.04 NVIDIA kernel flavour
• Jellyfin, Docker or another long-running service where reboots are often postponed

The notices cover many vulnerabilities across kernel subsystems. Do not decide that a server is unaffected merely because one named subsystem is unused; check the actual package candidates offered for the installed Ubuntu release and kernel flavour.

Check the release, running kernel and pending packages

cat /etc/os-release
uname -r
apt-cache policy linux-image-generic linux-generic
sudo apt update
apt list --upgradable 2>/dev/null | grep -E '^linux-(image|headers|modules|generic|nvidia|raspi)'

The grep command is a useful filter, not proof that no security update exists. Review the complete apt list --upgradable output and the relevant Ubuntu Security Notice before acting.

On a Raspberry Pi or an NVIDIA-flavoured host, record the installed kernel packages too:

dpkg-query -W 'linux-image*' 'linux-modules*' 2>/dev/null | grep '^linux-'

For an NVIDIA GPU server, capture a working baseline before the update:

nvidia-smi
dkms status

Not every NVIDIA kernel flavour uses DKMS, so an empty dkms status result is not automatically a fault.

Apply the supported updates

First preview the complete transaction:

sudo apt --simulate full-upgrade

Read the proposed package installations, upgrades and removals. After checking backups, free space and console access, apply the normal supported Ubuntu update:

sudo apt full-upgrade

Do not remove the previous working kernel immediately. It can provide a useful boot option if a driver, storage controller or network device behaves differently after the update.

Check whether a reboot is required

test -f /var/run/reboot-required && cat /var/run/reboot-required

If a reboot is required, finish package activity and schedule a maintenance window. Make sure storage mounts are documented and that local or out-of-band access is available before rebooting a remote-only server.

Ubuntu Livepatch can reduce exposure for covered fixes, but it does not mean every kernel flavour or every change is active without a reboot. Use the reboot-required state and Canonical’s notice for the installed packages.

Verify after reboot

uname -r
systemctl --failed
findmnt
journalctl -b -p warning --no-pager

Compare uname -r with the value recorded before the update. Then test outcomes rather than only checking that services are active:

• open Jellyfin and play a known Direct Play file
• run one known hardware transcode if the server uses a GPU
• confirm Docker containers, networks and bind mounts are healthy
• confirm SSH, DNS and remote access still work
• on NVIDIA hosts, run nvidia-smi again and check that the expected GPU appears
• on Raspberry Pi hosts, verify network, USB storage and any GPIO-dependent service used by the server

If the running kernel did not change, inspect the booted kernel, bootloader selection and package transaction before assuming the security update is active.

Official notices

• USN-8660-1: Linux kernel vulnerabilities for Ubuntu 26.04
• USN-8659-1: Linux kernel vulnerability for Ubuntu 26.04 and 24.04
• USN-8643-2: Linux kernel vulnerabilities for Ubuntu 24.04 and 22.04
• USN-8665-1: Linux kernel (Raspberry Pi) vulnerabilities
• USN-8669-1: Linux kernel (NVIDIA) vulnerabilities
• Ubuntu security notices

Further reading

Use the Home Lab Update Routine to separate the host-kernel update from Docker Engine, container-image and Jellyfin changes.

Ubuntu 26.04 is the reference for new SmallGrid Ubuntu work, but Ubuntu 24.04 remains supported. See Ubuntu 26.04 LTS Is Now the Reference for New Home Servers for that distinction.

Keep the permanent fix nearby

Affected SmallGrid guides

Primary source

This update is based on the official announcement: Ubuntu USN-8660-1.