CVE-2026-64413

Analyzed Analyzed - Analysis Complete

Linux Kernel ebtables Chainstack Array Use-After-Free

Publication date: 2026-07-25

Last updated on: 2026-09-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at CPU 2, the cleanup loop will blindly decrement and call vfree() on newinfo->chainstack[1]. Not a real-world bug, such allocation isn't expected to fail in the first place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-08

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64413

EUVD

EUVD-2026-48957

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 2.6.12.1 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 6.7 (inc) to 6.12.97 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ebtables table translation process. When the cpu_possible_mask is sparse (some CPUs missing), an allocation loop may skip certain CPUs. If memory allocation fails for a CPU, the cleanup process could incorrectly free uninitialized memory by calling vfree() on an invalid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ebtables module and involves a rare edge case with sparse CPU masks. Detection requires checking kernel logs for ebtables-related errors or examining kernel memory for uninitialized pointers. Commands like dmesg | grep ebtables or checking /var/log/kern.log may help identify issues.

Impact Analysis

This vulnerability is unlikely to impact real-world systems as the described allocation failure scenario is not expected to occur. It primarily affects edge cases with sparse CPU configurations and memory allocation failures during ebtables operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-risk kernel memory management issue unlikely to occur in practice. It involves a potential uninitialized pointer free in ebtables table translation under specific CPU configurations, which is not expected to impact data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this issue is patched. Avoid using ebtables on systems with sparse CPU configurations. Monitor kernel logs for ebtables-related errors after updates.

Hi! I’m here to help you understand CVE-2026-64413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70