CVE-2026-64412

A flaw was found in the Linux kernel's netfilter ebtables component. A local attacker could exploit this vulnerability by providing a specially crafted module name that is not properly null-terminated. This improper string handling could lead to a buffer over-read when the request_module() function processes the string. Successful exploitation could result in information disclosure, allowing an attacker to read sensitive kernel memory, or a denial of service (DoS), causing the system to crash.

ebtables accepted an extension name from a rule blob without verifying that the name is NUL terminated before passing it to xt_find_match and request_module. A local process able to update ebtables rules can provide a maximum length name without a terminator, causing kernel string handling to read beyond the fixed name field. For the CVSS the PR:L is used because reliable triggering requires local rule update capability such as CAP_NET_ADMIN, which may be delegated to a service account, container root, or network namespace user rather than full host root. The issue is not directly network reachable and is triggered through firewall control plane configuration, not by bridge packet traffic. Impact is mainly denial of service or warning through an out of bounds read, with at most limited confidentiality concern if adjacent kernel bytes influence the module request string.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.