CVE-2026-64411

A flaw was found in the Linux kernel's netfilter ebtables component. A local user could exploit this vulnerability by providing a specially crafted table name that is not properly terminated. This improper handling of the table name can lead to a stack-out-of-bounds read, potentially causing a system crash (Denial of Service) or the disclosure of sensitive information from kernel memory.

An unterminated ebtables table name can reach find_table_lock() and then request_module formatting on a lookup miss, causing vsnprintf() to read past the 32 byte name field into adjacent stack data. This is a local control plane issue through ebtables setsockopt handling, not a packet based network trigger. For the CVSS the PR:L value is used for the paranoid score because local attackers may reach the path through CAP_NET_ADMIN in a user namespace or delegated container context, even though many base systems require administrative firewall control. Impact is at least a local kernel stack out-of-bounds read. In the worst defensible case it may disclose kernel stack data through the generated module request name and may crash KASAN or hardened kernels. No write primitive is shown, so integrity impact is not assigned.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.