In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: fix table blob use-after-free
We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not.
t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
... this can return a valid table, with ret != 0.
This bug causes update of table->private with the new blob, but then frees the blob right away in the caller.
Syzbot report:
BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ...
ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.173-154.642Upgrade perfUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.102-61.139Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade kernel-livepatch-6.1.19-30.43Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-libbpf-develUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade perfUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-azure-fdeUpgrade linux-azureUpgrade linux-nvidia-tegra-5.15Upgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegraUpgrade linux-riscv-5.15Upgrade linux-gkeUpgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-hwe-5.15Upgrade linux-awsUpgrade linux-ibm-5.15Upgrade linux-realtimeUpgrade linuxUpgrade linux-nvidiaUpgrade linux-nvidia-tegra-igxUpgrade linux-gkeopUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-intel-iotgUpgrade linux-intel-iot-realtimeUpgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-gcp | Jan 6, 2026 | Jan 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 30, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub