Executive brief
A security vulnerability was identified in the Linux kernel's ebtables component, which manages network bridge filtering. A local attacker could potentially trigger an out-of-bounds memory read when the system processes specific 32-bit user structures on a 64-bit kernel. This could lead to system instability or the exposure of sensitive kernel memory information.
Technical details
An out-of-bounds (OOB) read vulnerability exists in net/bridge/netfilter/ebtables.c within the compat_mtw_from_user() function. The vulnerability is caused by a lack of proper validation for user-supplied match_size and target_size values when converting 32-bit user structures to kernel native structures. Specifically, the ->compat_from_user() callbacks assume they can safely read a fixed number of bytes (compatsize), but if a user provides a smaller size, the kernel performs an OOB read. The fix introduces match_size_ok() and tgt_size_ok() helpers to ensure the provided size meets the minimum required compatsize for matches, watchers, and targets.
Affected products
- Linux Linux kernel 81e675c227ec to d7a8fb6f10d5, 21af4c030567, dad9ebf81079, a27cb7325a6c, 7ad0e463fc7e, bf8e8eac7ede, f438d1786d65, fcc4c043d137
Timeline
- 2026-06-24: advisory: CVE-2026-52927 published
- 2026-06-19: patched: Fix committed to stable branches by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/21af4c030567d2e6c89bb927bc18b51fba52a400
- https://git.kernel.org/stable/c/7ad0e463fc7eafae2141cc38054264636f8b3e94
- https://git.kernel.org/stable/c/a27cb7325a6c69970041c7f8541fafed5a1ea3ec
- https://git.kernel.org/stable/c/bf8e8eac7ede51dc318e06acef5a896dcbba7595
- https://git.kernel.org/stable/c/d7a8fb6f10d55a1c37b0bf8c20cca24dffd76e00
- https://git.kernel.org/stable/c/dad9ebf8107955bb54bd3f9cf22591b6ff37bac1
- https://git.kernel.org/stable/c/f438d1786d657d57790c5d138d6db3fc9fdac392