CVE-2026-64411

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: terminate table name before find_table_lock()

update_counters() and compat_update_counters() forward a user-supplied

32-byte table name to find_table_lock() without NUL-terminating it. On a

lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",

"ebtable_", name), and vsnprintf() reads past the name field and the

stack object until it hits a zero byte.

BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)

Read of size 1 at addr ffff8880119dfb20 by task exploit/147

Call Trace:

...

string (lib/vsprintf.c:648 lib/vsprintf.c:730)

vsnprintf (lib/vsprintf.c:2945)

__request_module (kernel/module/kmod.c:150)

do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)

update_counters (net/bridge/netfilter/ebtables.c:1440)

do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)

nf_setsockopt (

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References