GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64127 (GCVE-0-2026-64127)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-19 15:40
VLAI
Title
Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid).
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1c08108f3014881ad5f4c35a2abaf9c65475035d , < ed5fcd2a26f0c16fc289c8cd6b03328a0582a687 (git)
Affected: 1c08108f3014881ad5f4c35a2abaf9c65475035d , < 051922ab709c0a6917eae765c22481dfc68379e5 (git)
Affected: 1c08108f3014881ad5f4c35a2abaf9c65475035d , < 356c9d1a1cbacd2a1640fff3c050e1c3472e924f (git)
Affected: 1c08108f3014881ad5f4c35a2abaf9c65475035d , < 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed5fcd2a26f0c16fc289c8cd6b03328a0582a687",
              "status": "affected",
              "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
              "versionType": "git"
            },
            {
              "lessThan": "051922ab709c0a6917eae765c22481dfc68379e5",
              "status": "affected",
              "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
              "versionType": "git"
            },
            {
              "lessThan": "356c9d1a1cbacd2a1640fff3c050e1c3472e924f",
              "status": "affected",
              "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
              "versionType": "git"
            },
            {
              "lessThan": "3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d",
              "status": "affected",
              "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer\n\nCommit 1c08108f3014 (\"Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end\nwarnings\") converted the on-stack request PDU in l2cap_ecred_reconfigure()\nfrom an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the\nsize and source-pointer arguments to l2cap_send_cmd():\n\n  -    struct {\n  -            struct l2cap_ecred_reconf_req req;\n  -            __le16 scid;\n  -    } pdu;\n  +    DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);\n       ...\n       l2cap_send_cmd(conn, chan-\u003eident, L2CAP_ECRED_RECONF_REQ,\n                      sizeof(pdu), \u0026pdu);\n\nAfter the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous\nunion pdu_u plus a local pointer \"pdu\" pointing at it. Therefore:\n\n  - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on\n    64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).\n  - \u0026pdu is the address of the local pointer\u0027s stack storage, not the\n    address of the request payload.\n\nl2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls\nskb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet\nbody therefore contains 8 bytes copied from the kernel stack starting at\n\u0026pdu -- the 8 bytes overlap the pdu pointer\u0027s value, leaking a kernel\nstack address to the paired Bluetooth peer. The intended (mtu, mps, scid)\nfields are not transmitted at all, so the peer rejects the request as\nmalformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken\nfor the local-side initiator since the introducing commit landed.\n\nThe sibling site l2cap_ecred_conn_req() in the same commit was converted\ncorrectly (sizeof(*pdu) + len, pdu); only this site was missed.\n\nRestore the original semantics: pass the full flex-struct size via\nstruct_size(pdu, scid, 1) and the pdu pointer (the struct address) as\nthe source.\n\nValidated on a stock 7.0-based host kernel via the real call path:\nsetsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED\nL2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ\nwhose body is 8 bytes (the on-stack pdu local\u0027s value) rather than\nthe expected 6. Three captures from fresh socket / fresh hciemu peer\non the same host -- low bytes vary per call, high 0xffff confirms a\nkernel virtual address (KASLR-randomised stack slot, not a fixed\nstring):\n\n  RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff\n  RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff\n  RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff\n\nAfter this patch the body is 6 bytes carrying the expected\nlittle-endian (mtu, mps, scid)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:40:23.960Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687"
        },
        {
          "url": "https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d"
        }
      ],
      "title": "Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64127",
    "datePublished": "2026-07-19T15:40:23.960Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-07-19T15:40:23.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64127",
      "date": "2026-09-19",
      "epss": "0.00127",
      "percentile": "0.02774"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ed5fcd2a26f0c16fc289c8cd6b03328a0582a687",
                    "status": "affected",
                    "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "051922ab709c0a6917eae765c22481dfc68379e5",
                    "status": "affected",
                    "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "356c9d1a1cbacd2a1640fff3c050e1c3472e924f",
                    "status": "affected",
                    "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d",
                    "status": "affected",
                    "version": "1c08108f3014881ad5f4c35a2abaf9c65475035d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11F1574D-E103-4C7C-A865-2F67FCCC845B",
                    "versionEndExcluding": "6.12.92",
                    "versionStartIncluding": "6.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer\n\nCommit 1c08108f3014 (\"Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end\nwarnings\") converted the on-stack request PDU in l2cap_ecred_reconfigure()\nfrom an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the\nsize and source-pointer arguments to l2cap_send_cmd():\n\n  -    struct {\n  -            struct l2cap_ecred_reconf_req req;\n  -            __le16 scid;\n  -    } pdu;\n  +    DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);\n       ...\n       l2cap_send_cmd(conn, chan-\u003eident, L2CAP_ECRED_RECONF_REQ,\n                      sizeof(pdu), \u0026pdu);\n\nAfter the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous\nunion pdu_u plus a local pointer \"pdu\" pointing at it. Therefore:\n\n  - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on\n    64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).\n  - \u0026pdu is the address of the local pointer\u0027s stack storage, not the\n    address of the request payload.\n\nl2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls\nskb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet\nbody therefore contains 8 bytes copied from the kernel stack starting at\n\u0026pdu -- the 8 bytes overlap the pdu pointer\u0027s value, leaking a kernel\nstack address to the paired Bluetooth peer. The intended (mtu, mps, scid)\nfields are not transmitted at all, so the peer rejects the request as\nmalformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken\nfor the local-side initiator since the introducing commit landed.\n\nThe sibling site l2cap_ecred_conn_req() in the same commit was converted\ncorrectly (sizeof(*pdu) + len, pdu); only this site was missed.\n\nRestore the original semantics: pass the full flex-struct size via\nstruct_size(pdu, scid, 1) and the pdu pointer (the struct address) as\nthe source.\n\nValidated on a stock 7.0-based host kernel via the real call path:\nsetsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED\nL2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ\nwhose body is 8 bytes (the on-stack pdu local\u0027s value) rather than\nthe expected 6. Three captures from fresh socket / fresh hciemu peer\non the same host -- low bytes vary per call, high 0xffff confirms a\nkernel virtual address (KASLR-randomised stack slot, not a fixed\nstring):\n\n  RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff\n  RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff\n  RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff\n\nAfter this patch the body is 6 bytes carrying the expected\nlittle-endian (mtu, mps, scid)."
          }
        ],
        "id": "CVE-2026-64127",
        "lastModified": "2026-08-13T15:11:11.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-07-19T16:17:54.387",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T16:45:00+00:00",
      "cve": "CVE-2026-64127",
      "id": "CVE-2026-64127",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64127.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:43:41Z",
      "cve": "CVE-2026-64127",
      "id": "CVE-2026-64127",
      "initial_release_date": "2026-07-21T12:59:12Z",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64127",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64127.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.