CVE-2026-52927

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ebtables: fix OOB read in compat_mtw_from_user<br /> <br /> Luxiao Xu says:<br /> <br /> The function compat_mtw_from_user() converts ebtables extensions from<br /> 32-bit user structures to kernel native structures. However, it lacks<br /> proper validation of the user-supplied match_size/target_size.<br /> <br /> When certain extensions are processed, the kernel-side translation<br /> logic may perform memory accesses based on the extension&amp;#39;s expected<br /> size. If the user provides a size smaller than what the extension<br /> requires, it results in an out-of-bounds read as reported by KASAN.<br /> <br /> This fix introduces a check to ensure match_size is at least as large<br /> as the extension&amp;#39;s required compatsize. This covers matches, watchers,<br /> and targets, while maintaining compatibility with standard targets.<br /> <br /> AFAIU this is relevant for matches that need to go though<br /> match-&gt;compat_from_user() call. Those that use plain memcpy with the<br /> user-provided size are ok because the caller checks that size vs the<br /> start of the next rule entry offset (which itself is checked vs. total<br /> size copied from userspace).<br /> <br /> The -&gt;compat_from_user() callbacks assume they can read compatsize bytes,<br /> so they need this extra check.<br /> <br /> Based on an earlier patch from Luxiao Xu.