CVE-2026-64411

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Linux Kernel ebtables

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte. BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ... compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64411

EUVD

EUVD-2026-48955

Affected Vendors & Products

Vendor	Product	Version / Range
netfilter	ebtables	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a stack-based out-of-bounds read in the ebtables netfilter module. When a 32-byte table name is passed without proper NUL-termination, the system reads beyond the intended memory area during a lookup miss, potentially exposing sensitive data or causing crashes.

Detection Guidance

This vulnerability involves a stack-out-of-bounds read in the Linux kernel's ebtables module. Detection requires checking kernel logs for KASAN stack-out-of-bounds errors related to ebtables or string operations in vsnprintf. Monitor logs for crashes or unusual module loading attempts.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory, leading to information disclosure or system instability. It may allow unauthorized access to data or enable denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability could compromise data confidentiality, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance violations if exploited, leading to legal or financial penalties.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Disable or restrict access to ebtables functionality if not required. Monitor for suspicious module loading attempts or crashes in kernel logs.

Hi! I’m here to help you understand CVE-2026-64411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70