CVE-2026-64537: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-64537DEBIAN-CVE-2026-64537
Published 27-07-2026Last modified 17-08-2026
Open JSON

Vulnerability summary

CVE-2026-64537 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.2% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 28 · Related 26
MGASA-2026-0336MGASA-2026-0337OPENSUSE-SU-2026:11476-1OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1

Timeline

  1. 27-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM. Fix this by validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.180-1 | < 6.12.100-1 | < 7.1.5-1
  • linux-6.12< 6.12.100-1~deb12u1
Linux1 product
  • linux≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 2870056a78961e0fecd652362ee9d3fcfd24a8a6 | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < f0f5eb59a97ece0d85de8cfa95dc18c609302a8b | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 53788b134519e995699ea3721969c96a08d64575 | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < b42aeb58317f12024734759ff745856b53948873 | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < a090880c1f544589427e5b7050c40fb211ccecb4 | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < 865643640b5b5c4579b32d7a55ac9ad648362eaa | ≥ 2be665c3940d367e0a2a8128eb4985ce323f99a3, < f3e02edd8322b31b8e6517faa6ba053bf29d1e26 | 5.11

3 vendors · 160 products

References

25 links
Show all 25 references