CVE-2025-21780 · cross-distro fix matrix

CVE-2025-21780: Qualys discovered that several vulnerabilities existed in the AppArmor

Affects 2 Linux releases across 50 (distro × package) combinations. First disclosed: 2026-04-20.

Fix per ecosystem

Each block below is a distro release where CVE-2025-21780 has a known fix. Run the listed command on that distro to remediate.

Ubuntu bionic

Source: Ubuntu USN

linux-raspi-5.4→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-5.4
```
linux-buildinfo-5.4.0-1139-raspi→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-buildinfo-5.4.0-1139-raspi
```
linux-headers-5.4.0-1139-raspi→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-headers-5.4.0-1139-raspi
```
linux-headers-raspi-5.4→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-headers-raspi-5.4
```
linux-headers-raspi-hwe-18.04→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-headers-raspi-hwe-18.04
```
linux-headers-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-headers-raspi-hwe-18.04-edge
```
linux-image-5.4.0-1139-raspi→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-image-5.4.0-1139-raspi
```
linux-image-raspi-5.4→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-image-raspi-5.4
```
linux-image-raspi-hwe-18.04→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-image-raspi-hwe-18.04
```
linux-image-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-image-raspi-hwe-18.04-edge
```
linux-modules-5.4.0-1139-raspi→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-modules-5.4.0-1139-raspi
```
linux-raspi-5.4→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-5.4
```
linux-raspi-5.4-headers-5.4.0-1139→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-5.4-headers-5.4.0-1139
```
linux-raspi-5.4-tools-5.4.0-1139→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-5.4-tools-5.4.0-1139
```
linux-raspi-hwe-18.04→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-hwe-18.04
```
linux-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-raspi-hwe-18.04-edge
```
linux-tools-5.4.0-1139-raspi→ fixed in5.4.0-1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-tools-5.4.0-1139-raspi
```
linux-tools-raspi-5.4→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-tools-raspi-5.4
```
linux-tools-raspi-hwe-18.04→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-tools-raspi-hwe-18.04
```
linux-tools-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.152~18.04.1USN-8098-10
```
sudo apt-get install --only-upgrade -y linux-tools-raspi-hwe-18.04-edge
```

Ubuntu focal

Source: Ubuntu USN

linux-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi

linux-buildinfo-5.4.0-1139-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-buildinfo-5.4.0-1139-raspi

linux-headers-5.4.0-1139-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-5.4.0-1139-raspi

linux-headers-raspi→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi

linux-headers-raspi-5.4→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi-5.4

linux-headers-raspi-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi-hwe-18.04

linux-headers-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi-hwe-18.04-edge

linux-headers-raspi2→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi2

linux-headers-raspi2-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi2-hwe-18.04

linux-headers-raspi2-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-headers-raspi2-hwe-18.04-edge

linux-image-5.4.0-1139-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-5.4.0-1139-raspi

linux-image-raspi→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi

linux-image-raspi-5.4→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi-5.4

linux-image-raspi-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi-hwe-18.04

linux-image-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi-hwe-18.04-edge

linux-image-raspi2→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi2

linux-image-raspi2-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi2-hwe-18.04

linux-image-raspi2-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-image-raspi2-hwe-18.04-edge

linux-modules-5.4.0-1139-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-modules-5.4.0-1139-raspi

linux-raspi→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi

linux-raspi-5.4→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi-5.4

linux-raspi-headers-5.4.0-1139→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi-headers-5.4.0-1139

linux-raspi-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi-hwe-18.04

linux-raspi-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi-hwe-18.04-edge

linux-raspi-tools-5.4.0-1139→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi-tools-5.4.0-1139

linux-raspi2→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi2

linux-raspi2-hwe-18.04→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi2-hwe-18.04

linux-raspi2-hwe-18.04-edge→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-raspi2-hwe-18.04-edge

linux-tools-5.4.0-1139-raspi→ fixed in5.4.0-1139.152USN-8098-10

sudo apt-get install --only-upgrade -y linux-tools-5.4.0-1139-raspi

linux-tools-raspi→ fixed in5.4.0.1139.170USN-8098-10

sudo apt-get install --only-upgrade -y linux-tools-raspi

Are YOU affected by CVE-2025-21780?

5-second check on your actual server. Reads /etc/os-release, uname -r, and the distro's package manager; matches against this same cross-source index live.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan View on NVD

Continuous monitoring beats manual checking

CVE-2025-21780dropped silently in your distro's update channel. Every new CVE is the same story. StackPatch runs the matcher hourly against all 5 sources and emails the exact remediation when something new applies to one of your servers. $99 lifetime, 50 founder seats, 30-day refund.

See StackPatch ($99 lifetime)