CVE-2026-64557

Canonical Ubuntu Linux: use-after-free

Risk score: 72/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 29 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is: A use-after-free vulnerability in the Linux kernel's Bluetooth L2CAP module allows an attacker to potentially crash the system or execute arbitrary code. An attacker could exploit this vulnerability to gain control of the system.
Affected: {'product': 'Linux kernel', 'vendor': 'Canonical', 'package': 'Ubuntu Linux', 'version': 'Unknown (no specific version mentioned)'}
Fix: Check the linked advisory for a fix, as no specific version or mitigation is provided.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

CVE-2026-64557: Use-after-free (CVSS 8.8 · EPSS 0%)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

Same weakness: Use-after-free (CWE-416). 400 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days

Why it is Amber

CVSS 8.8 high
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

References

Original description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied.

Last activity 6 Nov 2026. Patch Forecast updates every hour.