In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables… (CVE-2026-64413)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEs
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
AI-suggested
No specific patch or remediation details are provided. Since the vulnerability is resolved as stated, it is implied that an official fix is available. Users should apply the latest Linux kernel updates that include this fix. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.
Description
A vulnerability in the Linux kernel's netfilter ebtables component involves improper handling of a sparse cpu_possible_mask leading to potential use of an uninitialized pointer during cleanup. This issue arises if vmalloc_node() fails during allocation, causing the cleanup loop to incorrectly free memory at an unintended index. The vulnerability is not considered a practical real-world bug as such allocation failures are not expected.
Summary
The vulnerability in the Linux kernel's netfilter ebtables module relates to the handling of the chainstack array when cpu_possible_mask is sparse. Specifically, if CPU 0 and CPU 2 are possible but CPU 1 is not, the allocation loop skips CPU 1. If vmalloc_node() fails at CPU 2, the cleanup loop will decrement and call vfree() on newinfo->chainstack[1], which may be uninitialized. This could lead to use of an uninitialized pointer during memory free operations. However, the issue is theoretical since allocation failure in this context is not expected in real-world scenarios.
Impact
The vulnerability could lead to improper memory free operations, potentially causing memory corruption or kernel instability. The CVSS score of 7 with high impact on confidentiality, integrity, and availability reflects the severity if exploited. However, the practical exploitability is low due to the unlikely event of allocation failure in this scenario.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-64413 (opens in a new tab)
- git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8 (opens in a new tab)
- git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa (opens in a new tab)
- git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef (opens in a new tab)
- git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6 (opens in a new tab)
- git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088 (opens in a new tab)
- git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c (opens in a new tab)
- git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5 (opens in a new tab)
- git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.