Technical Summary

The Linux kernel netfilter ebtables subsystem contained a vulnerability in the compat_mtw_from_user() function, which converts ebtables extensions from 32-bit user structures to kernel-native structures. The function did not properly validate the user-supplied match_size and target_size parameters. If a user provided a size smaller than the extension's expected size, the kernel could perform out-of-bounds reads during translation, as detected by KASAN. The patch introduces validation to ensure match_size is at least the extension's required size, covering matches, watchers, and targets, while maintaining compatibility with standard targets. This prevents the kernel from reading memory beyond the allocated extension size.