{"id":"CVE-2026-64413","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-908"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.12.1, < 5.10.261","linux_kernel >= 5.11, < 5.15.212","linux_kernel >= 5.16, < 6.1.178","linux_kernel >= 6.2, < 6.6.145","linux_kernel >= 6.7, < 6.12.97","linux_kernel >= 6.13, < 6.18.39","linux_kernel >= 6.19, < 7.1.4","linux_kernel = 2.6.12","linux_kernel = 7.2"],"patched":["linux_kernel 7.1.4"],"published":"2026-07-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T09:18:19.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64413","references":[{"url":"https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00124,"epssPercentile":0.0247,"ingestedAt":"2026-09-08T15:33:26.949Z","slug":"CVE-2026-64413","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo->chainstack[1].\n\nNot a real-world bug, such allocation isn't expected to fail\nin the first place.\n\n## Affected\n\n- `linux_kernel >= 2.6.12.1, < 5.10.261`\n- `linux_kernel >= 5.11, < 5.15.212`\n- `linux_kernel >= 5.16, < 6.1.178`\n- `linux_kernel >= 6.2, < 6.6.145`\n- `linux_kernel >= 6.7, < 6.12.97`\n- `linux_kernel >= 6.13, < 6.18.39`\n- `linux_kernel >= 6.19, < 7.1.4`\n- `linux_kernel = 2.6.12`\n- `linux_kernel = 7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.4`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}