CVE-2026-64566
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate…
- Risk score
- 85/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 5 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical vulnerability in the Linux kernel allows an attacker to cause kernel-visible memory corruption and trigger a panic. This can happen when a new inner SKB is created with shared frags from a page-pool backed receive path.
- Affected
- {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
- Fix
- Check the linked advisory for the fix
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A critical vulnerability in the Linux kernel allows an attacker to cause kernel-visible memory corruption and trigger a panic. This can happen when a new inner SKB is created with shared frags from a page-pool backed receive path.
The flaws
- CVE-2026-64566: In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate… (CVSS 9.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the fix
Who is exposed: {'product': 'Ubuntu Linux', 'vendor': 'Canonical'}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
- 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the destination SKB's skb_shinfo->flags. If the source SKB carries shared frags (e.g. from a page-pool backed receive path), the new inner SKB will appear to ESP as having privately owned frags. A subsequent esp_input() call for a nested transport-mode SA then takes the no-COW fast path and decrypts in place, writing over pages that are still referenced by the outer IPTFS SKB. This causes kernel-visible memory corruption and can trigger a panic. All other frag-transfer helpers in the kernel (skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this convention by setting the flag inside the loop immediately after __skb_frag_ref() and nr_frags++, so every exit path that attaches a frag unconditionally propagates SKBFL_SHARED_FRAG.
Last activity 6 Nov 2026. Patch Forecast updates every hour.