Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in…

Risk score
40/100
CVSS
Not Scored
Exploit chance (30 days)
0.2%
Published
5 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is
In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32…
Affected
Canonical Ubuntu Linux
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Canonical Ubuntu LinuxTHE FLAWSTHE FIXCVE-2026-64569In the Linux kernel, thefollowing vulnerability has beenresolved: mpls: fix NULL deref…EPSS 0%CVE-2026-93479Heap buffer overflow can leadto remote code executionCVSS 8.1 · EPSS 1%CVE-2026-15176Heap buffer overflow can leadto remote code executionCVSS 8.1 · EPSS 1%CVE-2026-97205NGINX Plus and NGINX OpenSource have a vulnerability inthe ngx_http_core_module…CVSS 8.1 · EPSS 1%FixCheck the linked advisory forthe concrete fix.Who is exposed{'products': ['NGINX Plus','NGINX Open Source'],'packages': [], 'versions': []}RED · ACT TODAYCanonical UbuntuLinuxA vulnerability exists in NGINXPlus and NGINX Open Sourcewhen a map directive uses regexmatching and the root directiveor access log format referencesthe map's regex capturevariables before referencing…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.26 Oct · Ubuntu security noticesUSN-8955-1: nginx vulnerabilities5 Nov · Ubuntu security noticesUSN-8955-2: nginx vulnerabilities6 Nov · Ubuntu security noticesUSN-9003-1: Linux kernel (NVIDIA) vulnerabilitiesCONNECTS TOSame weaknessHeap buffer overflow (CWE-122)398 other warnings in 30 days →Same productEarlier Canonical Ubuntu Linux warnings147 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

  • CVE-2026-64569: In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in… (EPSS 0%)
  • CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
  • CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
  • CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

  • No known exploitation

How it unfolded

  1. 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
  2. 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
  3. 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

Why it is Yellow

  • Not yet scored by NVD
  • On your watchlist: linux kernel
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does.

Last activity 6 Nov 2026. Patch Forecast updates every hour.