CVE-2026-64412: netfilter: ebtables: module names must be null-terminated
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: module names must be null-terminated
We need to explicitly check the length, else we may pass non-null terminated string to requestmodule().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Compensating control
If you cannot patch immediately, ensure netfilter/ebtables module loading requests are only triggered with correctly formatted, null-terminated module name strings to avoid passing non-null-terminated data to request_module().
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What security impact could successful exploitation have?
The issue is rated high with CVSS 7.1. It can result in high confidentiality impact and high availability impact; integrity impact is listed as none.
Which systems are identified as affected?
The listed software includes the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. The provided data does not identify affected configuration prerequisites or fixed versions.