CVE-2026-64411VulnerabilityPublished 07/25/2026Updated 09/08/2026

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock()… (CVE-2026-64411)

Source GCVE Database

CVSS 3.1 base score

7.1High

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEs

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

What to do

AI-suggested

A fix has been implemented in the Linux kernel to properly NUL-terminate the user-supplied table name before passing it to find_table_lock(). Users should update their Linux kernel to a version that includes this fix. Since no specific patch links or versions are provided, check the official Linux kernel advisories or vendor updates for the patched versions. No additional mitigation is indicated by the vendor advisory.

Description

A high-severity vulnerability in the Linux kernel's netfilter ebtables component involves improper handling of a user-supplied table name that is not NUL-terminated before being passed to find_table_lock(). This can lead to a stack-out-of-bounds read in vsnprintf() when a lookup misses, potentially causing a kernel crash or other impact. The issue affects the update_counters() and compat_update_counters() functions. The vulnerability has been resolved by ensuring the table name is properly NUL-terminated before use.

Summary

The Linux kernel netfilter ebtables subsystem had a vulnerability (CVE-2026-64411) where update_counters() and compat_update_counters() forwarded a user-supplied 32-byte table name to find_table_lock() without terminating it with a NUL byte. On a lookup miss, this caused vsnprintf() to read beyond the intended buffer, resulting in a stack-out-of-bounds read detected by KASAN. The flaw arises because try_then_request_module() uses the unterminated string in a formatted print, causing memory safety violations. The fix involved terminating the table name properly in compat_do_replace() and ensuring all callers of find_table_lock() handle the name consistently.

Impact

This vulnerability allows a local attacker with low privileges to cause a stack-out-of-bounds read in kernel space, which can lead to a denial of service (kernel crash) and potentially expose kernel memory contents. The CVSS score of 7.1 reflects high confidentiality impact and high availability impact, with no integrity impact. There are no known exploits in the wild at this time.

Weaknesses

CWE-125Out-of-bounds Read (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 09/08/2026, 14:34:21 UTC

Technical details

Weaknesses

References

Related threats