Executive brief
A vulnerability was identified in the Linux kernel's ebtables component, which is used for filtering network traffic on Ethernet bridges. The issue involves how the system handles module names; if a name is not properly terminated, it could lead to unpredictable system behavior or memory issues when the kernel attempts to load a networking module. This could potentially be used by a local attacker to cause a system crash or impact operations.
Technical details
A vulnerability exists in 'net/bridge/netfilter/ebtables.c' within the Linux kernel where 'ebt_check_match' does not validate that the 'u.name' field in 'struct ebt_entry_match' is null-terminated. An attacker providing a specially crafted ebtables rule could cause 'xt_find_match' to pass a non-null-terminated string to 'request_module()'. This can lead to out-of-bounds memory reads or the attempted loading of unintended kernel modules. The fix introduces an explicit 'strnlen' check against 'XT_EXTENSION_MAXNAMELEN' to ensure all module names are properly terminated.
Affected products
- Linux Linux Kernel 4.6 to 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.10, 6.13.0
Timeline
- 2026-07-04: disclosed: Initial patch authored by Florian Westphal
- 2026-07-24: patched: Patches merged into multiple stable kernel branches
- 2026-07-25: advisory: CVE-2026-64412 published by NVD
References
- https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425
- https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa
- https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643
- https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96
- https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b
- https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8
- https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213