CVE-2026-64411

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ebtables: terminate table name before find_table_lock()<br /> <br /> update_counters() and compat_update_counters() forward a user-supplied<br /> 32-byte table name to find_table_lock() without NUL-terminating it. On a<br /> lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",<br /> "ebtable_", name), and vsnprintf() reads past the name field and the<br /> stack object until it hits a zero byte.<br /> <br /> BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)<br /> Read of size 1 at addr ffff8880119dfb20 by task exploit/147<br /> Call Trace:<br /> ...<br /> string (lib/vsprintf.c:648 lib/vsprintf.c:730)<br /> vsnprintf (lib/vsprintf.c:2945)<br /> __request_module (kernel/module/kmod.c:150)<br /> do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)<br /> update_counters (net/bridge/netfilter/ebtables.c:1440)<br /> do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)<br /> nf_setsockopt (net/netfilter/nf_sockopt.c:101)<br /> ip_setsockopt (net/ipv4/ip_sockglue.c:1424)<br /> raw_setsockopt (net/ipv4/raw.c:847)<br /> __sys_setsockopt (net/socket.c:2393)<br /> ...<br /> <br /> compat_do_replace() shares the same unterminated name via<br /> compat_copy_ebt_replace_from_user(); terminate it there too so all<br /> find_table_lock() callers behave alike. The other callers already<br /> terminate the name after the copy.