CVE-2026-64412

netfilter: ebtables: module names must be null-terminated

State: Published
Severity: 7.1 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: module names must be null-terminated

We need to explicitly check the length, else we may pass non-null terminated string to request_module().

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	bcf4934288402be3464110109a4dae3bd6fb3e93 to before 43dd2332b8a27b3ac5108791680cade654ab0f96Affected bcf4934288402be3464110109a4dae3bd6fb3e93 to before 5777c8f1c3610786d8482b8f620f40fccaf1542bAffected bcf4934288402be3464110109a4dae3bd6fb3e93 to before 0ddca0f90fa3395111d078ae4399615cf3ea94aaAffected bcf4934288402be3464110109a4dae3bd6fb3e93 to before d2367d99f2455f373996d9ddbe833dbe9f942213Affected bcf4934288402be3464110109a4dae3bd6fb3e93 to before da32e78bbb187ed7b137e0007034185570a3a172Affected bcf4934288402be3464110109a4dae3bd6fb3e93 to before 13a5f532e3a4fc75c33060a026def1572c208643Affected bcf4934288402be3464110109a4dae3bd6fb3e93 to before 7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8Affected bcf4934288402be3464110109a4dae3bd6fb3e93 to before 084d23f818321390509e9738a0b08bbf46df6425Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bcf4934288402be3464110109a4dae3bd6fb3e93 to before 43dd2332b8a27b3ac5108791680cade654ab0f96Affected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before 5777c8f1c3610786d8482b8f620f40fccaf1542bAffected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before 0ddca0f90fa3395111d078ae4399615cf3ea94aaAffected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before d2367d99f2455f373996d9ddbe833dbe9f942213Affected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before da32e78bbb187ed7b137e0007034185570a3a172Affected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before 13a5f532e3a4fc75c33060a026def1572c208643Affected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before 7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8Affected
bcf4934288402be3464110109a4dae3bd6fb3e93 to before 084d23f818321390509e9738a0b08bbf46df6425Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.