Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-85197

Canonical Ubuntu Linux: use-after-free can lead to remote code execution

Risk score
59/100
CVSS
7.6 v3.1
Exploit chance (30 days)
0.3%
Published
4 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asyn…
Affected
Canonical Ubuntu Linux
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Canonical Ubuntu LinuxTHE FLAWSTHE FIXCVE-2026-85197Use-after-free can lead toremote code executionCVSS 7.6 · EPSS 0%CVE-2026-74221Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-74220Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-103262Denial of serviceCVSS 7.5 · EPSS 1%Upgrade Canonical Ubuntu…2026.10 · 6.5.9or later on your release lineWho is exposedCanonical Ubuntu Linux before2026.10AMBER · PATCH THIS WEEKCanonical UbuntuLinuxU-Boot before 2026.10-rc5contains a buffer overflow innfs_readlink_reply() function innet/nfs-common.c whenprocessing NFS serverresponses. A malicious NFSserver can send crafted…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Ubuntu security noticesUSN-8930-2: U-Boot vulnerabilities21 Oct · Ubuntu security noticesUSN-8890-2: libsoup vulnerabilities22 Oct · Ubuntu security noticesUSN-8952-1: Tornado vulnerabilitiesCONNECTS TOSame weaknessUse-after-free (CWE-416)400 other warnings in 30 days →Same productEarlier Canonical Ubuntu Linux warnings15 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

The flaws

The fix

Upgrade Canonical Ubuntu Linux: 2026.10 · 6.5.9 or later on your release line

Who is exposed: Canonical Ubuntu Linux before 2026.10

Where it stands

  • No known exploitation

How it unfolded

  1. 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
  2. 21 Oct, Ubuntu security notices (official): USN-8890-2: libsoup vulnerabilities
  3. 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities

Connects to

Why it is Yellow

  • CVSS 7.6 high
  • Remotely exploitable without logging in
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.

Last activity 21 Oct 2026. Patch Forecast updates every hour.