Executive brief
A vulnerability was identified in the Linux kernel's ebtables component, which handles Ethernet bridge filtering. The issue could allow a partially-filled data structure to be exposed during table registration, potentially leading to system instability or crashes. This has been resolved by implementing a more secure two-stage removal and registration process.
Technical details
A vulnerability in the Linux kernel netfilter ebtables component was resolved by moving to a two-stage removal scheme. Previously, the `table->ops` assignment was performed outside of the ebt mutex, creating a window where a partially-filled `ebt_table` struct could be exposed to the system. An attacker with local access could potentially exploit this race condition to cause a kernel crash or other undefined behavior. The fix ensures that table operations are assigned while holding the mutex and introduces a 'dead_tables' list to safely manage the lifecycle of tables during removal. Patches have been backported to various stable kernel branches including 5.15.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux 5.15 to 6.18.34, 7.0.11
Timeline
- 2026-05-06: other: Patch authored
- 2026-07-19: disclosed: CVE published