In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: terminate table name before find_table_lock()

update_counters() and compat_update_counters() forward a user-supplied
32-byte table name to find_table_lock() without NUL-terminating it. On a
lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",
"ebtable_", name), and vsnprintf() reads past the name field and the
stack object until it hits a zero byte.

BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)
Read of size 1 at addr ffff8880119dfb20 by task exploit/147
Call Trace:
...
string (lib/vsprintf.c:648 lib/vsprintf.c:730)
vsnprintf (lib/vsprintf.c:2945)
__request_module (kernel/module/kmod.c:150)
do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)
update_counters (net/bridge/netfilter/ebtables.c:1440)
do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)
nf_setsockopt (net/netfilter/nf_sockopt.c:101)
ip_setsockopt (net/ipv4/ip_sockglue.c:1424)
raw_setsockopt (net/ipv4/raw.c:847)
__sys_setsockopt (net/socket.c:2393)
...

compat_do_replace() shares the same unterminated name via
compat_copy_ebt_replace_from_user(); terminate it there too so all
find_table_lock() callers behave alike. The other callers already
terminate the name after the copy.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 4c046ca4e35a83ea32f6e748f54139f5fe2a1d01
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < ab63ccefb9c71627f957a0724c2b9ebc869c6f20
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c6f539311e58e76aa96feef0f1572b13a564f8a2
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 2664f537ca5bcb2ef3fac2683dcca602e51fad24
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 7436da6c1bc44654b7f11a17e746f6999fd37250
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < b6183b1b88a722b6d8ea0cecc99eba168a15e0be
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < a622d2e9608c9dff47fc2e5759ac7aa3a836b45d
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.96 unaffected ≤ 6.12.*
6.18.39 unaffected ≤ 6.18.*
7.1.4 unaffected ≤ 7.1.*
7.2-rc3 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24 cve-icon
https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01 cve-icon
https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322 cve-icon
https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250 cve-icon
https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d cve-icon
https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20 cve-icon
https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be cve-icon
https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2 cve-icon
History

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte. BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ... compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.
Title netfilter: ebtables: terminate table name before find_table_lock()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T08:50:52.143Z

Reserved: 2026-07-19T15:36:31.786Z

Link: CVE-2026-64411

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.