In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: fix table blob use-after-free
We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not.
t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
... this can return a valid table, with ret != 0.
This bug causes update of table->private with the new blob, but then frees the blob right away in the caller.
Syzbot report:
BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ...
ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perfUpgrade kernel-livepatch-5.10.173-154.642Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.102-61.139 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.19-30.43Upgrade kernel-tools | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15Upgrade linuxUpgrade linux-gkeopUpgrade linux-nvidia-tegra-igxUpgrade linux-gcpUpgrade linux-oracle-5.15Upgrade linux-ibmUpgrade linux-intel-iot-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-lowlatencyUpgrade linux-nvidiaUpgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-azure-5.15Upgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azureUpgrade linux-nvidia-tegra-5.15Upgrade linux-gkeUpgrade linux-nvidia-tegraUpgrade linux-hwe-5.15Upgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-realtimeUpgrade linux-awsUpgrade linux-ibm-5.15Upgrade linux-riscv-5.15Upgrade linux-raspi | Jan 6, 2026 | Jan 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub