End of life since 2 April 2021
Ubuntu 16.04 end of life
Ubuntu 16.04 reached end of life on 2 April 2021. Canonical's Expanded Security Maintenance, sold with Ubuntu Pro, ran until April 2026. Its packages now stay at the versions below: the kernel, OpenSSH, OpenSSL, glibc, sudo and the rest. We backport security fixes to them, so the server keeps running while you plan the move.
- 14exploited vulnerabilities in its components
- 165critical
- 66months past end of life
What Ubuntu 16.04 still runs
| Component | Version | Package | Known CVEs |
|---|---|---|---|
| Linux kernel | 4.4 | 4.4.0.210.216-4.4.0.210.216 | 4,672 |
| glibc | 2.23 | 2.23-0ubuntu11.3 | |
| OpenSSL | 1.0.2g | 1.0.2g-1ubuntu4.20 | 62 |
| OpenSSH | 7.2p2 | 1:7.2p2-4ubuntu2.10 | 50 |
| sudo | 1.8.16 | 1.8.16-0ubuntu1.10 | |
| bash | 4.3 | 4.3-14ubuntu1.4 | |
| curl | 7.47.0 | 7.47.0-1ubuntu2.19 | |
| polkit | 0.105 | 0.105-14.1ubuntu0.5 | |
| systemd | 229 | 229-4ubuntu21.31 | |
| PHP | 7.0.33 | 7.0.33-0ubuntu0.16.04.16 | 26 |
| Python 2 | 2.7.12 | 2.7.12-1ubuntu0~16.04.18 | |
| Python 3 | 3.5.1 | 3.5.1-3 | |
| Apache httpd | 2.4.18 | 2.4.18-2ubuntu3.17 | |
| nginx | 1.10.3 | 1.10.3-0ubuntu0.16.04.5 | |
| MySQL | 5.7.33 | 5.7.33-0ubuntu0.16.04.1 | |
| PostgreSQL | 9.5 | 9.5+173ubuntu0.3 | |
| OpenJDK | 8u292 | 8u292-b10-0ubuntu1~16.04.1 |
Latest versions in the distribution's public repositories, 28 October 2026. Known CVEs: for the upstream version, from the US National Vulnerability Database. Distribution packages include fixes backported before end of life, so not every one of them applies; your assessment shows which risks are real.
Exploited vulnerabilities in Ubuntu 16.04's components
Vulnerabilities in the upstream versions of Ubuntu 16.04's kernel, OpenSSH, OpenSSL and PHP that are listed in the CISA catalogue of known exploited vulnerabilities, highest score first. Ubuntu 16.04 packages may include fixes made before end of life.
| CVE | Component | Score | Severity | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-22555 Exploited | Linux kernel | 8.3 | High | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space |
| CVE-2026-109619 Exploited | PHP | 8.1 | High | 2026-10-21 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2022-0492 Exploited | Linux kernel | 7.8 | High | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. |
| CVE-2024-1086 Exploited | Linux kernel | 7.8 | High | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. |
| CVE-2024-53104 Exploited | Linux kernel | 7.8 | High | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
| CVE-2024-53197 Exploited | Linux kernel | 7.8 | High | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. |
| CVE-2025-38352 Exploited | Linux kernel | 7.8 | High | 2025-07-22 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. |
| CVE-2025-39964 Exploited | Linux kernel | 7.8 | High | 2025-10-13 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. |
| CVE-2026-46300 Exploited | Linux kernel | 7.8 | High | 2026-05-23 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. |
| CVE-2024-53150 Exploited | Linux kernel | 7.1 | High | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. |
| CVE-2016-5195 Exploited | Linux kernel | 7.0 | High | 2016-11-10 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." |
| CVE-2021-0920 Exploited | Linux kernel | 6.4 | Medium | 2021-12-15 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel |
| CVE-2024-50302 Exploited | Linux kernel | 5.5 | Medium | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. |
| CVE-2022-2586 Exploited | Linux kernel | 5.3 | Medium | 2024-01-08 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. |
What you can do
Keep Ubuntu 16.04, patched
We backport the security fixes to the Ubuntu 16.04 packages you run: the kernel, OpenSSH, OpenSSL, glibc and the rest, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to Ubuntu 24.04 LTS, once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.