CVE-2026-64551

Canonical Ubuntu Linux: out-of-bounds read can lead to information disclosure

Risk score: 83/100
CVSS: 9.1 v3.1
Exploit chance (30 days): 0.5%
Published: 27 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is: A vulnerability in the Linux kernel's SCTP implementation allows an attacker to leak uninitialized memory by sending a specially crafted ERROR chunk. This could potentially lead to a high-confidence data leak.
Affected: {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
Fix: Check the linked advisory for a fix, as no specific version or package information is provided.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability in the Linux kernel's SCTP implementation allows an attacker to leak uninitialized memory by sending a specially crafted ERROR chunk. This could potentially lead to a high-confidence data leak.

The flaws

CVE-2026-64551: Out-of-bounds read can lead to information disclosure (CVSS 9.1 · EPSS 1%)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for a fix, as no specific version or package information is provided.

Who is exposed: {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

Same weakness: Out-of-bounds read (CWE-125). 399 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days

Why it is Red

CVSS 9.1 critical
Remotely exploitable without logging in
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

References

Original description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk->skb->data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb->tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.

Last activity 6 Nov 2026. Patch Forecast updates every hour.