CVE-2026-64413: netfilter: ebtables: zero chainstack array
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: zero chainstack array
sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free?
If cpupossiblemask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmallocnode() fails at CPU 2, the cleanup loop will blindly decrement and call vfree() on newinfo->chainstack[1].
Not a real-world bug, such allocation isn't expected to fail in the first place.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The system must have a sparse cpu_possible_mask, such as CPU 0 and CPU 2 being possible while CPU 1 is not. An allocation for the chainstack array must then fail for a later possible CPU, causing cleanup to attempt to free an uninitialized entry.
How likely is exploitation in normal deployments?
The report describes this as not a real-world bug because the required allocation failure is not expected to occur in practice. The issue is therefore dependent on an unusual CPU topology combined with an unlikely vmalloc_node() failure.
What should administrators do?
Apply an available patch. If patching cannot occur immediately, prioritize systems with sparse possible-CPU configurations, while recognizing that the triggering allocation failure is not expected under normal conditions.