CVE-2026-64562
Canonical Ubuntu Linux: use-after-free
- Risk score
- 69/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 4 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A high-severity vulnerability in the Linux kernel's KVM module allows an attacker to potentially execute arbitrary code with elevated privileges. An attacker could exploit this vulnerability to gain control over the system.
- Affected
- {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
- Fix
- Check the linked advisory for the fix, as no specific version or details are provided.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-64562: Use-after-free (CVSS 8.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
- 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
Connects to
- Same weakness: Use-after-free (CWE-416). 400 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-9003-1
- https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d
- https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7
- https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946
- https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3
- https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3
- https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412
- https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f
- https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab
Original description
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR. The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.
Last activity 6 Nov 2026. Patch Forecast updates every hour.