In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables… (CVE-2026-64413)
A vulnerability in the Linux kernel's netfilter ebtables component was identified and resolved. The issue involves improper handling of a sparse cpu_possible_mask leading to potential use of an uninitialized pointer during cleanup after a failed allocation. Although this flaw exists in the code, it is not considered a practical risk because the allocation failure scenario is not expected to occur in real-world environments.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-64413) in the Linux kernel's netfilter ebtables arises from the handling of the chainstack array when cpu_possible_mask is sparse. Specifically, if certain CPUs are not possible (e.g., CPU 1 missing between CPU 0 and CPU 2), the allocation loop skips those CPUs. If vmalloc_node() fails on a later CPU (CPU 2), the cleanup loop incorrectly attempts to free memory at an index corresponding to the skipped CPU (CPU 1), potentially leading to use of an uninitialized pointer. However, this allocation failure is not expected to happen in practice, making it unlikely to be exploitable.
Potential Impact
The impact is minimal as the allocation failure scenario that triggers the vulnerability is not expected in real-world usage. There are no known exploits in the wild. The vulnerability could theoretically cause improper memory free operations, but practical exploitation is unlikely.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue. Since the vulnerability is resolved, users should update to the fixed kernel versions once available. No additional mitigation is required beyond applying the official patch when released. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables… (CVE-2026-64413)
Description
A vulnerability in the Linux kernel's netfilter ebtables component was identified and resolved. The issue involves improper handling of a sparse cpu_possible_mask leading to potential use of an uninitialized pointer during cleanup after a failed allocation. Although this flaw exists in the code, it is not considered a practical risk because the allocation failure scenario is not expected to occur in real-world environments.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-64413) in the Linux kernel's netfilter ebtables arises from the handling of the chainstack array when cpu_possible_mask is sparse. Specifically, if certain CPUs are not possible (e.g., CPU 1 missing between CPU 0 and CPU 2), the allocation loop skips those CPUs. If vmalloc_node() fails on a later CPU (CPU 2), the cleanup loop incorrectly attempts to free memory at an index corresponding to the skipped CPU (CPU 1), potentially leading to use of an uninitialized pointer. However, this allocation failure is not expected to happen in practice, making it unlikely to be exploitable.
Potential Impact
The impact is minimal as the allocation failure scenario that triggers the vulnerability is not expected in real-world usage. There are no known exploits in the wild. The vulnerability could theoretically cause improper memory free operations, but practical exploitation is unlikely.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue. Since the vulnerability is resolved, users should update to the fixed kernel versions once available. No additional mitigation is required beyond applying the official patch when released. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-48r8-x424-wvc7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64413"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8084434
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:27:23 UTC
Last updated: 07/26/2026, 05:25:01 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.