Executive brief
A race condition vulnerability was identified in the Linux kernel's ebtables component, which handles Ethernet bridge filtering. This flaw could allow a local attacker to interact with networking options before the system has finished setting them up, potentially leading to system instability or a crash. The issue has been resolved in recent kernel updates.
Technical details
A race condition exists in net/bridge/netfilter/ebtables.c during module initialization. The vulnerability occurs because nf_register_sockopt() was called before the per-network namespace subsystem (register_pernet_subsys) was fully initialized. Once nf_register_sockopt() completes, the socket options are exposed globally; if accessed immediately by a local user, it can lead to a race condition where the kernel attempts to use uninitialized or partially initialized structures. The fix reorders the initialization sequence to ensure that socket options are registered last, consistent with other netfilter modules like iptables. Patches are available in stable kernel branches including 6.18.34 and 7.0.11.
Affected products
- Linux Linux Kernel 5.13 to 6.18.34, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory