CVE-2026-64411

netfilter: ebtables: terminate table name before find_table_lock()

State: Published
Severity: 7.1 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: terminate table name before find_table_lock()

update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte.

BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ...

compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4c046ca4e35a83ea32f6e748f54139f5fe2a1d01Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ab63ccefb9c71627f957a0724c2b9ebc869c6f20Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c6f539311e58e76aa96feef0f1572b13a564f8a2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2664f537ca5bcb2ef3fac2683dcca602e51fad24Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7436da6c1bc44654b7f11a17e746f6999fd37250Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b6183b1b88a722b6d8ea0cecc99eba168a15e0beAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a622d2e9608c9dff47fc2e5759ac7aa3a836b45dAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4c046ca4e35a83ea32f6e748f54139f5fe2a1d01Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ab63ccefb9c71627f957a0724c2b9ebc869c6f20Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c6f539311e58e76aa96feef0f1572b13a564f8a2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2664f537ca5bcb2ef3fac2683dcca602e51fad24Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7436da6c1bc44654b7f11a17e746f6999fd37250Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b6183b1b88a722b6d8ea0cecc99eba168a15e0beAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a622d2e9608c9dff47fc2e5759ac7aa3a836b45dAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.