CVE-2026-64537
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid…
- Risk score
- 40/100
- CVSS
- Not Scored
- Exploit chance (30 days)
- 0.2%
- Published
- 27 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-64537: In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid… (EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
- 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days
Why it is Yellow
- Not yet scored by NVD
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-9003-1
- https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6
- https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575
- https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa
- https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4
- https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873
- https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b
- https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26
Original description
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM. Fix this by validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).
Last activity 6 Nov 2026. Patch Forecast updates every hour.