CVE-2026-64411

What the bug is

update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte. BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ... compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/bridge/netfilter/ebtables.c

What this is

NETFILTERMAINTAINERS section matched on net/*/netfilter/ · netfilter-devel@vger.kernel.org · Maintained

Kernel module

ebtables

Check it on the machine

grep -wE 'CONFIG_BRIDGE|CONFIG_BRIDGE_NF_EBTABLES|CONFIG_BRIDGE_NF_EBTABLES_LEGACY|CONFIG_NETFILTER' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ebtables

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 2 releases. It does build it in 3 releases, so the answer depends on which release the machine runs.

• bookworm, trixiem
• forky, sidn
• bookworm · linux-6.12m

m

a loadable module on every flavour - check lsmod, can be blacklisted

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_BRIDGE, CONFIG_BRIDGE_NF_EBTABLES, CONFIG_BRIDGE_NF_EBTABLES_LEGACY, CONFIG_NETFILTER

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-07-25 (3 months ago)source

CVSS

7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it

Attack vector

local (AV:L)source

EPSS

0.13%, higher than 2.4% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/bridge

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	5.10.261	4c046ca4e35a
2.6.12	5.15.212	ab63ccefb9c7
2.6.12	6.1.178	c6f539311e58
2.6.12	6.6.145	2664f537ca5b
2.6.12	6.12.96	7436da6c1bc4
2.6.12	6.18.39	6fe8d3cecd20
2.6.12	7.1.4	b6183b1b88a7
2.6.12	7.2	a622d2e9608c

Debian advisories