Improper Initialization in Linux kernel - CVE-2026-64413

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the ebtables table translation logic in net/bridge/netfilter/ebtables.c when allocating and freeing the chainstack array. A local user can trigger an allocation failure during table translation to cause a denial of service.

The issue arises when a sparse cpu_possible_mask causes an uninitialized chainstack entry to be freed during cleanup.

Affected software

How to mitigate CVE-2026-64413

External References

• https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8
• https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa
• https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef
• https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6
• https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088
• https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c
• https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5
• https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc

Related Security Bulletins

• Improper Initialization in Linux kernel bridge netfilter
• Debian update for linux