The Linux kernel netfilter ebtables subsystem had a vulnerability (CVE-2026-64411) where update_counters() and compat_update_counters() forwarded a user-supplied 32-byte table name to find_table_lock() without terminating it with a NUL byte. On a lookup miss, this caused vsnprintf() to read beyond the intended buffer, resulting in a stack-out-of-bounds read detected by KASAN. The flaw arises because try_then_request_module() uses the unterminated string in a formatted print, causing memory safety violations. The fix involved terminating the table name properly in compat_do_replace() and ensuring all callers of find_table_lock() handle the name consistently.

This vulnerability allows a local attacker with low privileges to cause a stack-out-of-bounds read in kernel space, which can lead to a denial of service (kernel crash) and potentially expose kernel memory contents. The CVSS score of 7.1 reflects high confidentiality impact and high availability impact, with no integrity impact. There are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel to properly NUL-terminate the user-supplied table name before passing it to find_table_lock(). Users should update their Linux kernel to a version that includes this fix. Since no specific patch links or versions are provided, check the official Linux kernel advisories or vendor updates for the patched versions. No additional mitigation is indicated by the vendor advisory.