CVE-2026-64412: Linux Kernel Netfilter Ebtables Vulnerability

CVE-2026-64412 Overview

CVE-2026-64412 is a Linux kernel vulnerability in the netfilterebtables subsystem. The flaw stems from missing length validation on module name strings passed to request_module(). Without an explicit length check, the kernel may pass a non-null-terminated string to the module loader, leading to out-of-bounds memory reads and potential kernel instability.

The issue affects local, authenticated users with the ability to interact with the ebtables interface. Exploitation can result in information disclosure from adjacent kernel memory or a denial-of-service condition through kernel crashes.

Critical Impact
A local attacker with sufficient privileges to configure ebtables rules can trigger an out-of-bounds memory read in the kernel, potentially causing a kernel panic or leaking sensitive kernel memory contents.

Affected Products

Linux Kernel (mainline and stable branches receiving the referenced backports)
Distributions shipping vulnerable netfilter/ebtables code prior to the fix commits
Systems where ebtables bridge filtering is available and loadable

Discovery Timeline

2026-07-25 - CVE-2026-64412 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64412

Vulnerability Analysis

The vulnerability resides in the netfilterebtables code path that resolves match, watcher, and target module names before invoking request_module(). The kernel accepts module name strings supplied through user-controlled ebtables rule submissions.

Without an explicit length verification, the string is treated as null-terminated when passed to the module loading routine. If the buffer is not null-terminated within its declared size, request_module() reads beyond the intended boundary. This produces undefined behavior including out-of-bounds reads of kernel memory adjacent to the input buffer.

The consequences include reading uninitialized or unrelated kernel data into the module name comparison logic, potential loading of unintended modules, and kernel crashes when the read crosses unmapped memory. The fix, backported across multiple stable trees in commits including 084d23f, 0ddca0f, 13a5f53, 43dd233, 5777c8f, 7b21796, d2367d9, and da32e78, adds an explicit length check to guarantee null-termination before the module lookup proceeds.

Root Cause

The root cause is missing input validation on the length and termination of user-supplied module name strings in the ebtables interface. The code implicitly trusted that provided module name buffers were null-terminated, violating safe string handling practices for user-controlled data crossing the kernel boundary.

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN capability or equivalent privileges within a user namespace that permits ebtables configuration. An attacker submits an ebtables rule containing a crafted match, watcher, or target name field where the module name buffer lacks a terminating null byte. When the kernel attempts to load the referenced module, it reads past the buffer, triggering the vulnerable code path.

See the kernel commit 084d23f and related backports for the technical fix details.

Detection Methods for CVE-2026-64412

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ebtables, ebt_check_entry, or request_module in dmesg and /var/log/kern.log
Unusual modprobe or request_module invocations for ebt_* modules that do not correspond to legitimate administrative activity
Unexpected loading of bridge netfilter modules on hosts where ebtables is not actively configured

Detection Strategies

Monitor kernel logs for repeated crashes or warnings originating in net/bridge/netfilter/ code paths
Audit process activity for non-administrative users or containers invoking ebtables binaries or issuing related netlink calls
Track kernel module load events via auditd rules on the init_module and finit_module syscalls to flag anomalous module resolution attempts

Monitoring Recommendations

Deploy auditd rules capturing ebtables netlink activity and correlate with the source process, user, and namespace
Alert on kernel panics or soft lockups on production hosts and forward kernel telemetry to a centralized logging platform for retention and search
Baseline expected ebt_* module load events per host and alert on deviations, particularly from container workloads

How to Mitigate CVE-2026-64412

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution that incorporates the referenced upstream commits
Restrict CAP_NET_ADMIN grants and disable unprivileged user namespaces where operationally feasible to reduce the local attack surface
Inventory hosts and containers that expose ebtables functionality and prioritize patching those with untrusted local users or workloads

Patch Information

The fix has been merged upstream and backported to stable kernel trees. Reference commits include 084d23f818321390509e9738a0b08bbf46df6425, 0ddca0f90fa3395111d078ae4399615cf3ea94aa, 13a5f532e3a4fc75c33060a026def1572c208643, 43dd2332b8a27b3ac5108791680cade654ab0f96, 5777c8f1c3610786d8482b8f620f40fccaf1542b, 7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8, d2367d99f2455f373996d9ddbe833dbe9f942213, and da32e78bbb187ed7b137e0007034185570a3a172. Consult your distribution's security advisory for the exact package version containing the backport.

Workarounds

Blacklist the ebtables and bridge netfilter modules on systems that do not require Layer 2 filtering to prevent the vulnerable code path from being reachable
Remove CAP_NET_ADMIN from container runtime defaults and audit any workloads that explicitly request the capability
Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions supporting the tunable, reducing exposure from non-root local users

bash

# Configuration example: disable ebtables module loading until patched
echo 'install ebtables /bin/true' | sudo tee /etc/modprobe.d/disable-ebtables.conf
echo 'install ebtable_filter /bin/true' | sudo tee -a /etc/modprobe.d/disable-ebtables.conf
echo 'install ebtable_nat /bin/true' | sudo tee -a /etc/modprobe.d/disable-ebtables.conf

# Restrict unprivileged user namespaces to reduce local attack surface
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system