CVE-2026-64413: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64413 Overview

CVE-2026-64413 is a Linux kernel vulnerability in the netfilter subsystem's ebtables component. The flaw involves a potential uninitialized pointer free in the chainstack array during ebtables table translation when cpu_possible_mask is sparse. If vmalloc_node() fails during allocation for a valid CPU, the cleanup loop can call vfree() on skipped, uninitialized entries in the chainstack array. The upstream fix zeroes the chainstack array during allocation so the cleanup path only touches valid pointers. Kernel maintainers note this is not a real-world bug because such an allocation is not expected to fail in the first place.

Critical Impact
A local, low-privileged user with the ability to load ebtables rulesets could trigger an uninitialized pointer free in the kernel under a sparse CPU topology combined with allocation failure, potentially leading to memory corruption or denial of service.

Affected Products

Linux kernel netfilter subsystem — ebtables component
Linux stable branches referenced by upstream commits 29bf41a9b59a, 2ade612967e2, 42bef500d07b, 5ee856e4208a, 9e6c5169db42, 9f74d28e903f, cbfe53599eeb, and fc7f10545104
Systems configured with a sparse cpu_possible_mask

Discovery Timeline

2026-07-25 - CVE-2026-64413 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64413

Vulnerability Analysis

The vulnerability resides in the ebtables table translation logic within the Linux kernel netfilter subsystem. During ebtables initialization, the kernel allocates per-CPU chainstack entries using vmalloc_node() in a loop that iterates over cpu_possible_mask. When the mask is sparse, meaning some CPU indices are absent (for example, CPU 0 and CPU 2 present but CPU 1 missing), the allocation loop skips absent indices and leaves the corresponding chainstack array slots uninitialized.

If vmalloc_node() fails on a later CPU, the error-handling path walks the array backward and calls vfree() on every index it decrements past. Because skipped slots were never initialized to NULL, vfree() receives an uninitialized pointer. The result is an invalid free on kernel memory, which can corrupt kernel heap state or crash the system.

Root Cause

The root cause is missing initialization of the chainstack array combined with an asymmetric allocation and cleanup pattern. The allocation loop is guarded by cpu_possible_mask, but the cleanup loop is not. This is an Uninitialized Memory Use issue that manifests as a double free or wild pointer free on the failure path.

Attack Vector

Exploitation requires local access with privileges sufficient to configure ebtables rules, typically CAP_NET_ADMIN in a user namespace. The attacker must also trigger the allocation failure path on a system where cpu_possible_mask is sparse. Because vmalloc_node() failure at ebtables setup time is not expected under normal conditions, upstream maintainers classify this as a theoretical rather than practical bug. The vulnerability is not remotely reachable and has no known public exploit.

The upstream fix zero-initializes the chainstack array so that the cleanup loop encounters NULL for skipped CPU slots. vfree(NULL) is safe and short-circuits without touching invalid memory. See the commit references for the exact patch.

Detection Methods for CVE-2026-64413

Indicators of Compromise

Unexpected kernel oops or BUG: messages referencing vfree() called from ebtables translation paths in dmesg or journalctl -k.
Kernel panics tied to ebt_register_table or related netfilter bridging code following ebtables ruleset changes.
Systems reporting vmalloc allocation failures immediately preceding ebtables configuration errors.

Detection Strategies

Inventory running kernel versions across the Linux fleet and compare against the fixed commits listed in the upstream git.kernel.org references.
Audit which hosts have ebtables and bridging modules loaded, and which workloads or containers hold CAP_NET_ADMIN in a user namespace.
Correlate kernel crash telemetry with ebtables usage patterns to surface anomalous failure clusters.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on vfree traces originating in netfilter or ebtables symbols.
Track loading of ebtables and br_netfilter kernel modules on production hosts that do not require bridge filtering.
Monitor container runtimes for creation of user namespaces that grant CAP_NET_ADMIN, which is a prerequisite for reaching the vulnerable code path.

How to Mitigate CVE-2026-64413

Immediate Actions Required

Apply the latest Linux stable kernel updates from your distribution vendor that include the ebtables chainstack zero-initialization fix.
If patching is not immediately possible, unload ebtables kernel modules on hosts that do not require Ethernet bridge filtering.
Restrict CAP_NET_ADMIN in user namespaces to reduce the number of unprivileged callers that can configure ebtables.

Patch Information

The fix has been merged into the upstream Linux kernel and backported to multiple stable branches. Refer to the commit references for the specific patches: 29bf41a9b59a, 2ade612967e2, 42bef500d07b, 5ee856e4208a, 9e6c5169db42, 9f74d28e903f, cbfe53599eeb, and fc7f10545104. The change updates the allocation path to zero the chainstack array so the cleanup loop cannot call vfree() on uninitialized entries.

Workarounds

Blacklist the ebtables and ebtable_filter modules on systems that do not require Layer 2 filtering.
Disable unprivileged user namespaces where operationally acceptable via sysctl kernel.unprivileged_userns_clone=0 or the equivalent distribution control.
Use seccomp or LSM policies to restrict access to the setsockopt and netlink interfaces used to configure ebtables.

bash

# Configuration example: disable ebtables modules on hosts that do not need bridge filtering
echo 'install ebtables /bin/true' | sudo tee /etc/modprobe.d/disable-ebtables.conf
echo 'install ebtable_filter /bin/true' | sudo tee -a /etc/modprobe.d/disable-ebtables.conf
sudo modprobe -r ebtable_filter ebtables 2>/dev/null || true

# Restrict unprivileged user namespaces (reduces attack surface for CAP_NET_ADMIN abuse)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system