CVE-2026-64413
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at CPU 2, the cleanup loop will blindly decrement and call vfree() on newinfo->chainstack[1]. Not a real-world bug, such allocation isn't expected to fail in the first place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64413
EUVD
EUVD-2026-48957

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netfilter ebtables *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ebtables table translation process. When the cpu_possible_mask is sparse (some CPUs missing), an allocation loop may skip certain CPUs. If memory allocation fails for a CPU, the cleanup process could incorrectly free uninitialized memory by calling vfree() on an invalid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ebtables module and involves a rare edge case with sparse CPU masks. Detection requires checking kernel logs for ebtables-related errors or examining kernel memory for uninitialized pointers. Commands like dmesg | grep ebtables or checking /var/log/kern.log may help identify issues.

Impact Analysis

This vulnerability is unlikely to impact real-world systems as the described allocation failure scenario is not expected to occur. It primarily affects edge cases with sparse CPU configurations and memory allocation failures during ebtables operations.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this issue is patched. Avoid using ebtables on systems with sparse CPU configurations. Monitor kernel logs for ebtables-related errors after updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart