CVE-2026-64412

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable ebtables replacement path is reached through a local setsockopt syscall, not through received network traffic.

AC:LAttack complexity, low

The attacker controls the complete table blob, including offsets, allocation size, and unterminated match name; no race or uncontrollable condition is required.

PR:LPrivileges required, low

The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain by creating user and network namespaces on deployments permitting unprivileged user namespaces.

UI:NUser interaction, none

Exploitation requires no action by another user after the attacker invokes setsockopt with the crafted table.

S:UScope, unchanged

The vulnerability affects the host kernel within the same security authority and does not cross a virtualization or IOMMU boundary.

C:HConfidentiality impact, high

The unbounded %s traversal constitutes an out-of-bounds kernel read that can continue beyond the match-name field and table allocation; under the required higher-severity treatment for unbounded OOB reads, confidentiality impact is High.

I:NIntegrity impact, none

The vulnerable operation only reads while formatting a module name; there is no demonstrated out-of-bounds write, use-after-free, or control-flow modification primitive.

A:HAvailability impact, high

A page-aligned nonzero table blob can make vsnprintf scan into the vmalloc guard page, causing a kernel oops or panic, and the attacker can repeat the trigger.