CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: terminate table name before findtablelock()
updatecounters() and compatupdatecounters() forward a user-supplied 32-byte table name to findtablelock() without NUL-terminating it. On a lookup miss, findinlistlock() calls trythenrequestmodule(..., "%s%s", "ebtable", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte.
BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) requestmodule (kernel/module/kmod.c:150) doupdatecounters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) updatecounters (net/bridge/netfilter/ebtables.c:1440) doebtsetctl (net/bridge/netfilter/ebtables.c:2573) nfsetsockopt (net/netfilter/nfsockopt.c:101) ipsetsockopt (net/ipv4/ipsockglue.c:1424) rawsetsockopt (net/ipv4/raw.c:847) syssetsockopt (net/socket.c:2393) ...
compatdoreplace() shares the same unterminated name via compatcopyebtreplacefromuser(); terminate it there too so all findtablelock() callers behave alike. The other callers already terminate the name after the copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64411?
CVE-2026-64411 has a severity rating of high with a CVSS score of 7.1.
How do I fix CVE-2026-64411?
To fix CVE-2026-64411, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What are the risks associated with CVE-2026-64411?
CVE-2026-64411 poses a risk of potentially critical data exposure due to its high severity status.
Which versions of the Linux kernel are affected by CVE-2026-64411?
CVE-2026-64411 affects versions of the Linux kernel that incorporate the netfilter and ebtables modules without the necessary checks.
What does CVE-2026-64411 impact?
CVE-2026-64411 impacts the integrity of the Linux kernel's handling of user-supplied table names in ebtables, potentially leading to denial of service.