CVE-2026-64411 netfilter: ebtables: terminate table name before find_table_lock()

High 7.1 Published 25 Jul 2026 Updated 19 Oct 2026

A missing null terminator in ebtables allows attackers to read out-of-bounds kernel stack memory via crafted socket options.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64411?

CVE-2026-64411 is a high-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: terminate table name before find_table_lock()

update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte.

BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ...

compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.

Weakness: CWE-125

Which versions are affected by CVE-2026-64411?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-64411?

Apply the vendor's patch.

Is CVE-2026-64411 being exploited?

There is no known exploitation of CVE-2026-64411 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-93461, BELL-CVE-2026-64411, DEBIAN-CVE-2026-64411, GHSA-x29v-26mm-796j, ROOT-OS-DEBIAN-12-CVE-2026-64411, ROOT-OS-UBUNTU-2204-CVE-2026-64411 and 1 more.