🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026
Affected versions: Ubuntu 20.04 (focal)

📖 ~4 min read  •  Source: Ubuntu Security Notice USN-8002-1

Related CVEs: CVE-2026-21945 CVE-2026-21933 CVE-2026-21932 CVE-2026-21925 CVE-2025-53057 CVE-2025-53066 CVE-2025-61748 CVE-2025-30754  +12 more

Upstream summary: It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)

Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution – Primary Fix
  7. Solution – Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

openjdk-21 is executed by every process started from it, so a flaw here surfaces inside your applications rather than in openjdk-21 itself: header-parsing and request-smuggling bugs in the bundled HTTP stack, weaknesses in the runtime’s own TLS and crypto code, unsafe archive, XML or deserialisation handling in the standard library, or memory-safety bugs in the JIT. Long-lived workers such as application servers, JVM daemons and resident node processes keep executing the old build after Ubuntu 20.04 replaces it on disk, so a patched machine stays exposed until each one is restarted. openjdk-21 is an interpreter or virtual machine plus its standard library, not a daemon: it runs only inside processes you start, so there is no openjdk-21 unit to restart — restart the applications that execute it instead.

Environment & Reproduction

Reproduction targets Ubuntu 20.04 (focal). Confirm release and installed package:

lsb_release -a
cat /etc/os-release
dpkg -l openjdk-21 | tail -2
apt-cache policy openjdk-21
uname -r

Exercise the workload that uses openjdk-21 while collecting:

needrestart -b -r l  # (pkg: needrestart) run as root; machine-readable. NEEDRESTART-SVC = units still mapping deleted libs, NEEDRESTART-SESS = login sessions, NEEDRESTART-KSTA = kernel state. -r l never restarts anything
needrestart -v -l -r l  # human-readable, libraries only (-l); names each PID and the obsolete file it still maps
checkrestart -v  # (pkg: debian-goodies) older alternative; add -p to report only deleted files owned by a dpkg package, -m for machine-readable
sudo journalctl -xe --no-pager | tail -200
sudo tail -200 /var/log/apt/history.log
sudo tail -200 /var/log/kern.log | grep -i apparmor

Root Cause Analysis

Root cause is documented in Ubuntu Security Notice USN-8002-1. Canonical security maintainers shipped fixes in the corresponding openjdk-21 update for Ubuntu 20.04; running an outdated build leaves the host exposed to the failure modes described in the advisory. Fixes land in the focal-security pocket of the main archive. Correlate apt history with the journal:

grep -A2 -B2 openjdk-21 /var/log/apt/history.log
zgrep -A2 -B2 openjdk-21 /var/log/apt/history.log.*.gz 2>/dev/null
cat /proc/sys/kernel/tainted   # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Ubuntu 20.04 to capture the current state of openjdk-21:

dpkg -l openjdk-21 | tail -1                  # installed version
dpkg -V openjdk-21                             # verify shipped files
sudo apt update && apt list --upgradable 2>/dev/null | grep -i security
systemctl daemon-reload  # only if the upgrade shipped changed unit files
systemctl daemon-reexec  # REQUIRED after a systemd / libsystemd upgrade: re-execs PID 1 against the new library without rebooting (needrestart flags this as 'systemd-manager')
needrestart -r i  # (pkg: needrestart) interactive: prompts per service. The safe default on a production box
needrestart -r a  # non-interactive: restarts EVERY flagged unit. Maintenance window only -- it will bounce databases and web servers without asking
sudo ufw status verbose 2>/dev/null | head -20
sudo aa-status 2>/dev/null | head -20
# If openjdk-21 ships a service unit (unit/job name often differs from pkg name, e.g.
# bind9→named, apache2→apache2, postgresql-NN→postgresql@NN-main):
dpkg-query -L openjdk-21 2>/dev/null | grep -E '^/etc/init\.d/[^/]+$'  # legacy SysV init script; its basename is the service name for 'service <name> restart' on non-systemd hosts
systemctl list-unit-files --no-pager --type=service,socket,timer | grep -iF -- 'openjdk-21'  # fuzzy name match; -F is required because package names contain regex metacharacters ('+' in libstdc++6/g++-13 makes -E fail to match at all)

Step-by-Step Diagnosis

  1. List failing services.

    systemctl --failed --no-pager

  2. Tail the journal / syslog for openjdk-21.

    sudo journalctl -xe -f --no-pager

  3. Inspect UFW (Uncomplicated Firewall) state.

    sudo ufw status numbered
sudo ufw show added
sudo iptables -L -n -v | head -30

  4. Surface AppArmor denials and switch the profile to complain mode if needed.

    sudo journalctl -k 2>/dev/null | grep -i 'apparmor="DENIED"' | tail -30
sudo aa-status
# /etc/apparmor.d/usr.bin.openjdk-21 or usr.sbin.openjdk-21 — inspect first
sudo aa-complain /etc/apparmor.d/usr.bin.openjdk-21 2>/dev/null || true

  5. Verify openjdk-21 integrity and reinstall if anything is altered.

    sudo dpkg -V openjdk-21
sudo debsums -c openjdk-21 2>/dev/null
sudo apt install --reinstall -y openjdk-21

  6. Correlate findings with /var/log/apt/history.log, /var/log/dpkg.log, and Ubuntu Security Notice USN-8002-1 to pin the change that introduced the regression.

Solution – Primary Fix

Apply the corrective apt transaction referenced by Ubuntu Security Notice USN-8002-1, then reload the affected service:

sudo apt update
sudo apt -y install --only-upgrade openjdk-21
sudo systemctl daemon-reload
# Service name may differ from pkg name; check first:
dpkg -l openjdk-21 | tail -1            # confirm new version

For kernel / glibc / systemd / openssl advisories a reboot (or Livepatch) is required:

sudo apt install -y needrestart
sudo needrestart -r l       # list units that need restart
sudo systemctl reboot       # or: sudo shutdown -r now
# Livepatch (Ubuntu Pro) avoids reboot for many kernel CVEs:
sudo canonical-livepatch status
sudo canonical-livepatch refresh

Need help rolling this patch across an Ubuntu fleet? Our IT Solutions & Services team manages Ubuntu patch windows with Landscape and Ubuntu Pro integration. Get in touch for a free consultation.

Solution – Alternative Approaches

If the primary upgrade is not viable, pick from these:

  • Hold the package so apt cannot upgrade it:

    sudo apt-mark hold openjdk-21
apt-mark showhold | grep openjdk-21
# Release the hold later with:
sudo apt-mark unhold openjdk-21

  • Pin a known-good version via apt preferences:

    # /etc/apt/preferences.d/openjdk-21.pref
Package: openjdk-21
Pin: version <good-version>
Pin-Priority: 1001

  • Downgrade to an older version if a regression is suspected:

    apt-cache madison openjdk-21
sudo apt install --allow-downgrades -y openjdk-21=<older-version>

  • Investigate AppArmor blocking the new binary; switch to complain briefly, capture denials, then re-enforce:

    sudo aa-complain /etc/apparmor.d/usr.bin.openjdk-21 2>/dev/null
# reproduce the failure
sudo journalctl -k | grep apparmor | tail
sudo aa-enforce /etc/apparmor.d/usr.bin.openjdk-21 2>/dev/null

  • Apply Canonical Livepatch (Ubuntu Pro) to land kernel fixes without reboot:

    sudo canonical-livepatch status
sudo canonical-livepatch refresh

  • Take only the security pocket update and defer the full point-release upgrade:

    sudo apt -y install --only-upgrade -t focal-security openjdk-21

Verification & Acceptance Criteria

All of these should pass after the fix is applied:

dpkg -l openjdk-21 | tail -1                                  # expected fixed version
apt list --upgradable 2>/dev/null | grep -i security || echo OK
sudo ufw status numbered | head
sudo aa-status 2>/dev/null | head -5

The conditions described in the advisory must no longer be reported for openjdk-21 across two consecutive runs.

Rollback Plan

Capture state before any change:

apt list --installed 2>/dev/null > /root/apt-pre.txt
dpkg --get-selections > /root/dpkg-pre.txt
# ZFS-on-root (Ubuntu 20.04+ default installer option):
sudo zfs snapshot rpool/ROOT/ubuntu@pre-openjdk-21
# LVM-on-root:
sudo lvcreate -L 4G -s -n root_pre_patch /dev/<vg>/<root-lv>

To revert:

sudo apt install --allow-downgrades -y openjdk-21=<old-version>
sudo systemctl daemon-reload
# Kernel rollback: pick the prior kernel from the GRUB menu, then:
sudo systemctl reboot
# ZFS rollback (rolls the whole root dataset):
sudo zfs rollback -r rpool/ROOT/ubuntu@pre-openjdk-21

Prevention & Hardening

Reduce the chance of this recurring on Ubuntu 20.04 (focal):

  • Enable scheduled security updates via unattended-upgrades:

    sudo apt install -y unattended-upgrades update-notifier-common
sudo dpkg-reconfigure -plow unattended-upgrades
# /etc/apt/apt.conf.d/50unattended-upgrades:
Unattended-Upgrade::Allowed-Origins { "${distro_id}:${distro_codename}-security"; };

  • Install needrestart so services restart automatically after library upgrades:

    sudo apt install -y needrestart
# /etc/needrestart/needrestart.conf -> $nrconf{restart} = 'a';

  • Attach Ubuntu Pro to enable Livepatch and extended security coverage:

    sudo pro attach <token>
sudo pro enable livepatch

  • Subscribe to ubuntu-security-announce and watch ubuntu.com/security/cves.

  • Monitor file integrity with debsums and AIDE:

    sudo apt install -y debsums aide
sudo debsums -ca
sudo aideinit && sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
sudo aide --check

  • For estate-wide patching, manage with Canonical Landscape:

    sudo apt install -y landscape-client
sudo landscape-config

  • Keep AppArmor profiles in enforce mode and apply CIS Ubuntu Linux Benchmark hardening.

Issues that commonly surface alongside a openjdk-21 update: apt lock contention, broken dpkg state, systemd ordering cycles, AppArmor denials, and UFW rule drift. Useful triage:

sudo dpkg --configure -a
sudo apt --fix-broken install
systemd-analyze critical-chain
sudo journalctl -k 2>/dev/null | grep -i apparmor | tail
cat /proc/sys/kernel/tainted

View all ubuntu-20-04 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Ubuntu Security Notice USN-8002-1. Manual pages useful on Ubuntu 20.04:

man apt
man apt-get
man apt-mark
man dpkg
man systemctl
man journalctl
man ufw
man apparmor
man aa-status
man unattended-upgrades
man canonical-livepatch
man pro

Other resources: Ubuntu Security Notices, Ubuntu CVE Tracker, Ubuntu upgrade notes, and per-package notes in /usr/share/doc/openjdk-21/ for components implicated in this advisory.