CVE-2026-64535

Canonical Ubuntu Linux: double free

Risk score: 79/100
CVSS: 9.8 v3.1
Published: 27 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability in the Linux kernel's nvmet-tcp module allows a potential use-after-free (UAF) attack when a data digest mismatch occurs. An attacker could exploit this to achieve high impact, including code execution, information disclosure, and denial of service.
Affected: {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
Fix: Check the linked advisory for a fix, as no specific version is given.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

CVE-2026-64535: Double free (CVSS 9.8)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

Same weakness: Double free (CWE-415). 54 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 163 in the last 90 days

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

References

Original description

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.

Last activity 6 Nov 2026. Patch Forecast updates every hour.