Executive brief
A vulnerability was identified in the Linux kernel's ebtables component, which manages Ethernet bridge filtering. Under specific conditions involving multi-core processor configurations and memory allocation failures, the system could attempt to free memory that was never properly initialized. While considered a low-risk issue that is unlikely to occur in standard operations, it could theoretically lead to a system crash or instability.
Technical details
A vulnerability in 'net/bridge/netfilter/ebtables.c' in the Linux kernel arises from the 'translate_table' function failing to zero-initialize the 'chainstack' array. On systems with a sparse 'cpu_possible_mask' (e.g., non-contiguous CPU IDs), the allocation loop skips indices corresponding to non-possible CPUs. If a subsequent 'vmalloc_node' call fails, the error cleanup path decrements through the array and calls 'vfree' on these uninitialized indices. This results in an uninitialized pointer free, potentially causing a kernel panic. The issue is mitigated by the fact that such memory allocations rarely fail in practice. The fix replaces 'vmalloc_array' with 'vcalloc' to ensure the array is zeroed upon allocation.
Affected products
- Linux Linux 2.6.12 to 5.10.261, 5.15.212, 6.1.127, 6.6.74, 6.12.11, 6.13.1
Timeline
- 2026-07-25: disclosed: Published in NVD and kernel stable trees
- 2026-07-24: patched: Commits applied to various stable branches by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8
- https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa
- https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef
- https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6
- https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088
- https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c
- https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5