High 7.1Published Jul 25, 2026

CVE-2026-64411netfilter: ebtables: terminate table name before find_table_lock()

Updated under an hour ago (Oct 27, 2026, 12:23 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads past the name field and the stack object until it hits a zero byte. BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) Read of size 1 at addr ffff8880119dfb20 by task exploit/147 Call Trace: ... string (lib/vsprintf.c:648 lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) __request_module (kernel/module/kmod.c:150) do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) update_counters (net/bridge/netfilter/ebtables.c:1440) do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) nf_setsockopt (net/netfilter/nf_sockopt.c:101) ip_setsockopt (net/ipv4/ip_sockglue.c:1424) raw_setsockopt (net/ipv4/raw.c:847) __sys_setsockopt (net/socket.c:2393) ... compat_do_replace() shares the same unterminated name via compat_copy_ebt_replace_from_user(); terminate it there too so all find_table_lock() callers behave alike. The other callers already terminate the name after the copy.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4c046ca4e35a83ea32f6e748f54139f5fe2a1d01; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ab63ccefb9c71627f957a0724c2b9ebc869c6f20; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c6f539311e58e76aa96feef0f1572b13a564f8a2; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2664f537ca5bcb2ef3fac2683dcca602e51fad24; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7436da6c1bc44654b7f11a17e746f6999fd37250; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b6183b1b88a722b6d8ea0cecc99eba168a15e0be; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a622d2e9608c9dff47fc2e5759ac7aa3a836b45d	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 2.6.12; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01	patch
https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20	patch
https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2	patch
https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24	patch
https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250	patch
https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322	patch
https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be	patch
https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.