CVE-2026-64411

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: terminate table name before find_table_lock()

update_counters() and compat_update_counters() forward a user-supplied

32-byte table name to find_table_lock() without NUL-terminating it. On a

lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",

"ebtable_", name), and vsnprintf() reads past the name field and the

stack object until it hits a zero byte.

BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)

Read of size 1 at addr ffff8880119dfb20 by task exploit/147

Call Trace:

...

string (lib/vsprintf.c:648 lib/vsprintf.c:730)

vsnprintf (lib/vsprintf.c:2945)

__request_module (kernel/module/kmod.c:150)

do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)

update_counters (net/bridge/netfilter/ebtables.c:1440)

do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)

nf_setsockopt (net/netfilter/nf_sockopt.c:101)

ip_setsockopt (net/ipv4/ip_sockglue.c:1424)

raw_setsockopt (net/ipv4/raw.c:847)

__sys_setsockopt (net/socket.c:2393)

...

compat_do_replace() shares the same unterminated name via

compat_copy_ebt_replace_from_user(); terminate it there too so all

find_table_lock() callers behave alike. The other callers already

terminate the name after the copy.