CVE-2026-52927: Linux Kernel netfilter ebtables Out-of-Bounds Read Vulnerability

Technical summary

CVE-2026-52927 is an out-of-bounds read vulnerability in the compat_mtw_from_user() function within the Linux kernel's netfilter ebtables compatibility layer. The function converts 32-bit user-space ebtables extension structures to 64-bit kernel structures without properly validating that user-supplied match_size and target_size fields meet the minimum requirements of the extension being processed. Extensions that implement compat_from_user() callbacks expect to read a specific number of bytes (compatsize); when a user provides a smaller size value, the callback reads beyond the allocated buffer. The vulnerability affects matches, watchers, and targets that rely on these callbacks. Standard targets using plain memcpy are unaffected because the caller validates size against rule boundary offsets.

Business impact

This vulnerability allows local privilege escalation and information disclosure on systems running affected Linux kernels. An unprivileged local attacker can trigger kernel memory leaks, potentially exposing sensitive data such as cryptographic keys, addresses used for ASLR bypass, or other kernel-resident secrets. Additionally, out-of-bounds reads can cause kernel panics, enabling a local denial-of-service attack. Organizations relying on Linux-based firewalls, container hosts, or multi-tenant systems should treat this as a material risk to confidentiality and availability.

Affected systems

The Linux kernel is affected. The vulnerability resides in the netfilter ebtables subsystem, which is typically enabled on systems using ebtables for bridging firewall rules. This includes container hosts (Docker, Kubernetes), virtual machine hypervisors, and dedicated firewall appliances running Linux. Any system with CONFIG_BRIDGE_NETFILTER and ebtables module loaded or built-in is potentially vulnerable. Verify your specific kernel version and ebtables configuration against the official Linux security advisories.

Exploitability

Exploitation requires local code execution privileges (non-root user context). An attacker must be able to run userspace applications and invoke ebtables rule-setting operations via netlink sockets, typically available to unprivileged processes on permissive systems. No network interaction, special hardware, or kernel debugging symbols are necessary. The attack is deterministic and does not depend on timing or luck. The CVSS vector (AV:L/AC:L/PR:L) reflects this local, low-complexity attack surface. The vulnerability is not currently tracked in the CISA KEV catalog, but its ease of exploitation and high impact make it a priority for patching.

Remediation

Apply the Linux kernel security patch that introduces validation checks in compat_mtw_from_user() to ensure user-supplied match_size and target_size fields are at least as large as the extension's required compatsize. Patches have been merged into the upstream Linux kernel; verify the specific version available for your distribution. As an interim mitigation on systems where ebtables is not in use, disable the netfilter bridge module (modprobe -r bridge_netfilter) and rebuild the kernel without CONFIG_BRIDGE_NETFILTER if feasible. Restrict local user access where possible.

Patch guidance

Check the official Linux kernel stable branch advisories and your Linux distribution's security bulletins for patched versions. Patches are available in the upstream Linux kernel repository following the CVE publication date (June 24, 2026). Major distributions (Red Hat, Debian, Ubuntu, SUSE) will issue kernel updates; prioritize applying these as soon as they are available for your kernel branch. Test patches in a non-production environment first, as kernel updates require system reboots. Verify that the patch addresses the compat_mtw_from_user() validation logic before deploying.

Detection guidance

Monitor kernel logs for KASAN (Kernel Address Sanitizer) warnings or out-of-bounds read messages if debugging is enabled. In production environments without KASAN, detect anomalous ebtables rule additions via auditd rules tracking netlink ebtables operations (look for NETLINK_NETFILTER messages with rule-setting syscalls). Correlate local process execution with privilege escalation attempts shortly after rule modifications. Host-based intrusion detection systems (HIDS) can flag suspicious local process behavior following kernel memory access violations. Network-based detection is not applicable; focus on endpoint instrumentation.

Why prioritize this

HIGH severity due to local privilege escalation potential, high impact (confidentiality, integrity, availability), low attack complexity, and broad applicability to Linux systems using ebtables. Although KEV status is not active, the ease of exploitation and direct memory safety violation warrant immediate patching. Container and virtualization platforms are particularly at risk because unprivileged container users may access ebtables interfaces. Organizations operating multi-tenant infrastructure should treat this as critical.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector requiring login but no special privileges beyond standard user context; (2) Low attack complexity—no environmental conditions or user interaction needed; (3) High impact across confidentiality (kernel memory disclosure), integrity (potential state corruption), and availability (kernel panic). The score appropriately captures the real-world threat when systems permit unprivileged users local access, which is common in container, VM, and shared hosting scenarios.

Frequently asked questions