CVE-2026-52927

What the bug is

Luxiao Xu says: The function compat_mtw_from_user() converts ebtables extensions from 32-bit user structures to kernel native structures. However, it lacks proper validation of the user-supplied match_size/target_size. When certain extensions are processed, the kernel-side translation logic may perform memory accesses based on the extension's expected size. If the user provides a size smaller than what the extension requires, it results in an out-of-bounds read as reported by KASAN. This fix introduces a check to ensure match_size is at least as large as the extension's required compatsize. This covers matches, watchers, and targets, while maintaining compatibility with standard targets. AFAIU this is relevant for matches that need to go though match->compat_from_user() call. Those that use plain memcpy with the user-provided size are ok because the caller checks that size vs the start of the next rule entry offset (which itself is checked vs. total size copied from userspace). The ->compat_from_user() callbacks assume they can read compatsize bytes, so they need this extra check. Based on an earlier patch from Luxiao Xu.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/bridge/netfilter/ebtables.c

What this is

NETFILTERMAINTAINERS section matched on net/*/netfilter/ · netfilter-devel@vger.kernel.org · Maintained

Kernel module

ebtables

Check it on the machine

grep -wE 'CONFIG_BRIDGE|CONFIG_BRIDGE_NF_EBTABLES|CONFIG_BRIDGE_NF_EBTABLES_LEGACY|CONFIG_NETFILTER' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ebtables

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.

• bookworm, trixiem
• forky, sidn

m

a loadable module on every flavour - check lsmod, can be blacklisted

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_BRIDGE, CONFIG_BRIDGE_NF_EBTABLES, CONFIG_BRIDGE_NF_EBTABLES_LEGACY, CONFIG_NETFILTER

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-06-24 (4 months ago)source

CVSS

7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it

Attack vector

local (AV:L)source

EPSS

0.12%, higher than 1.7% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/bridge

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.34	5.10.259	d7a8fb6f10d5
2.6.34	5.15.210	21af4c030567
2.6.34	6.1.176	dad9ebf81079
2.6.34	6.6.143	a27cb7325a6c
2.6.34	6.12.93	7ad0e463fc7e
2.6.34	6.18.35	bf8e8eac7ede
2.6.34	7.0.12	fcc4c043d137
2.6.34	7.1	f438d1786d65

Debian advisories