CVE-2026-64411: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64411 Overview

CVE-2026-64411 is a stack out-of-bounds read vulnerability in the Linux kernel's netfilter ebtables subsystem. The flaw resides in update_counters() and compat_update_counters(), which forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. When a table lookup misses, find_inlist_lock() invokes try_then_request_module() with a %s format specifier, causing vsnprintf() to read past the name field and adjacent stack memory until it encounters a zero byte. A local attacker with low privileges can trigger the out-of-bounds read via the setsockopt() system call path, leading to information disclosure or a kernel crash.

Critical Impact
A local, low-privileged attacker can trigger a stack out-of-bounds read in the kernel, potentially causing denial of service or leaking adjacent stack memory contents.

Affected Products

Linux Kernel (netfilter ebtables subsystem)
Kernel builds where CONFIG_BRIDGE_NF_EBTABLES is enabled
Distributions shipping the vulnerable ebtables code prior to the referenced stable commits

Discovery Timeline

2026-07-25 - CVE-2026-64411 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64411

Vulnerability Analysis

The vulnerability lives in the bridge netfilter ebtables code paths that handle counter updates from user space. When user space calls setsockopt() with EBT_SO_SET_COUNTERS, the kernel copies a 32-byte table name field into a local ebt_replace structure. The name buffer is a fixed-size character array, and if user space fills all 32 bytes without a terminating NUL byte, subsequent string processing operates on an unterminated buffer.

On a table lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name). The %s conversion in vsnprintf() walks the name pointer byte by byte, searching for a NUL terminator that does not exist within the intended 32-byte bound. Reading continues past the name field and into adjacent stack memory, as confirmed by the KASAN report showing stack-out-of-bounds inside string() at lib/vsprintf.c:648.

Root Cause

The root cause is missing input sanitization on a user-controlled fixed-length string field. The update_counters() and compat_update_counters() functions in net/bridge/netfilter/ebtables.c forward the raw name field to find_table_lock() without forcing name[EBT_TABLE_MAXNAMELEN - 1] = '\0'. The compat helper compat_copy_ebt_replace_from_user() exhibits the same defect. Other callers already terminate the name after copying, making these paths inconsistent outliers.

Attack Vector

Exploitation requires local access and the ability to invoke setsockopt() on a raw socket with the ebtables option, which typically requires CAP_NET_ADMIN in the appropriate namespace. Unprivileged users in a user namespace with CAP_NET_ADMIN inside that namespace can also reach the vulnerable path. The attacker submits a crafted ebt_replace structure where the 32-byte name field is filled entirely with non-NUL bytes. The subsequent module load attempt triggers the out-of-bounds read, which can cause a kernel oops on hardened builds or leak adjacent stack data through resulting kernel log entries and module request strings.

No verified public exploit code is available. See the Linux Kernel Commit 2664f53 and the other referenced patches for the exact code paths.

Detection Methods for CVE-2026-64411

Indicators of Compromise

KASAN reports containing stack-out-of-bounds in string originating from do_update_counters or compat_copy_ebt_replace_from_user.
Kernel oops or panic traces referencing vsnprintf, __request_module, and do_ebt_set_ctl in the call stack.
Unusual request_module events attempting to load modules with names prefixed ebtable_ followed by non-printable or garbage characters.

Detection Strategies

Audit setsockopt() syscalls targeting SOL_IP with the ebtables option (EBT_SO_SET_COUNTERS) originating from non-administrative processes or from within containers.
Enable kernel hardening features such as KASAN in test environments to surface any exploitation attempts during fuzzing.
Correlate module load requests with unexpected or malformed module names via kmod and auditd telemetry.

Monitoring Recommendations

Forward kernel logs (dmesg, /var/log/kern.log) to a central log platform and alert on ebtables-related crash signatures.
Monitor container runtime configurations that grant CAP_NET_ADMIN inside user namespaces, since this expands the reachable attack surface.
Track syscall telemetry via auditd or eBPF sensors for anomalous setsockopt activity referencing bridge netfilter options.

How to Mitigate CVE-2026-64411

Immediate Actions Required

Apply the upstream stable kernel patches listed in the references and reboot affected hosts.
Restrict CAP_NET_ADMIN inside user namespaces on multi-tenant hosts and container platforms until patched kernels are deployed.
Unload and blacklist ebtables and related bridge netfilter modules on systems that do not require Layer 2 filtering.

Patch Information

The fix ensures the table name is NUL-terminated before it reaches find_table_lock() and applies the same termination in compat_copy_ebt_replace_from_user() so all callers behave uniformly. Patches are available in the following upstream commits: 2664f53, 4c046ca, 6fe8d3c, 7436da6, a622d2e, ab63ccef, b6183b1b, and c6f53931. Consume distribution kernel updates as they are released downstream.

Workarounds

Blacklist the ebtables and ebtable_* kernel modules where bridge filtering is not needed by adding entries to /etc/modprobe.d/.
Disable auto-loading of netfilter modules by setting install ebtables /bin/true in modprobe configuration.
Enforce SELinux or AppArmor policies that deny CAP_NET_ADMIN to untrusted workloads and containers.

bash

# Blacklist ebtables modules until the kernel patch is applied
echo 'blacklist ebtables' | sudo tee /etc/modprobe.d/cve-2026-64411.conf
echo 'install ebtables /bin/true' | sudo tee -a /etc/modprobe.d/cve-2026-64411.conf

# Verify no ebtables-related modules are currently loaded
lsmod | grep -E 'ebtable|ebtables'

# Remove loaded modules if present
sudo modprobe -r ebtable_filter ebtable_nat ebtable_broute ebtables 2>/dev/null