Out-of-bounds read in Linux kernel - CVE-2026-64411
Published: July 27, 2026
Vulnerability identifier: #VU139564
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64411
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.
The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.
Affected software
Linux kernel
How to mitigate CVE-2026-64411
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24
- https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01
- https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322
- https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250
- https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d
- https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20
- https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be
- https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2