CVE-2026-52927

What it actually does

This is an out-of-bounds read in the Linux kernel netfilter ebtables compatibility conversion path. When a 32-bit userspace process on a compatible 64-bit kernel submits ebtables match, watcher, or target data, compat_mtw_from_user() may trust a user-supplied match_size or target_size that is smaller than the size expected by the kernel extension callback. A malicious or malformed ebtables rule can cause the kernel to read beyond the supplied structure while translating it into native kernel format. The most likely impacts are kernel memory disclosure to adjacent parsing logic, kernel warning/OOPS, or denial of service if the invalid read triggers a fault or sanitizer check; reliable privilege escalation is not indicated by the available information.

Why it matters to the business

Systems that allow users or workloads to manipulate ebtables rules could be destabilized by a local attacker or compromised container/workload with sufficient network administration privileges. The operational risk is highest on Linux hosts that enable 32-bit compatibility, bridge firewalling/ebtables, container networking, or unprivileged user namespaces that may allow CAP_NET_ADMIN inside a namespace. This issue is not currently listed in CISA KEV, is not known to be used in ransomware, has very low EPSS, and has no public exploit maturity reported, so it should be prioritized as a kernel hardening and availability fix rather than an emergency internet-facing remote-code-execution event.

How an attack unfolds

An attacker first needs local code execution on a Linux system and a way to invoke ebtables/netfilter rule replacement operations, typically requiring CAP_NET_ADMIN in the relevant network namespace. On a 64-bit kernel with 32-bit compatibility support, the attacker runs a 32-bit process or otherwise reaches the compat setsockopt path used for ebtables rule updates. They craft an ebtables rule containing a match, watcher, or target extension whose declared user-supplied size is smaller than the extension's expected compatibility structure size. During rule translation, compat_mtw_from_user() passes the malformed data into extension-specific compat_from_user() logic that assumes the larger structure is readable, causing an out-of-bounds kernel read. Depending on memory layout and kernel configuration, the result may be a kernel warning, OOPS/panic, service disruption, or exposure of adjacent kernel memory within the conversion path.

How to fix it

Upgrade to a kernel version from the relevant Linux distribution or vendor that includes the upstream netfilter ebtables fix adding minimum-size validation for match_size/target_size against the extension compatibility size. No exact fixed package versions were provided in the input, so use vendor advisories for the deployed distribution and kernel stream. Where immediate patching is not possible, reduce exposure by restricting CAP_NET_ADMIN, disabling or tightly controlling unprivileged user namespaces, limiting container privileges, avoiding privileged containers, and preventing untrusted users from loading or modifying ebtables rules. If ebtables/bridge netfilter is not required, consider disabling related modules or preventing autoloading according to distribution guidance, while validating that this does not break container networking, virtualization, firewalls, or bridge filtering.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, contains the fix by checking the active kernel version against the distribution advisory or changelog for the ebtables compat_mtw_from_user size-validation patch. Validate whether the host is exposed by checking for 32-bit compatibility support, ebtables/bridge netfilter module availability or use, and whether untrusted users or containers can obtain CAP_NET_ADMIN. Review configuration for unprivileged user namespaces and privileged containers. After patching, reboot into the fixed kernel if required and verify that old vulnerable kernels are not still booted. Functional validation should include normal ebtables, bridge firewall, and container networking rule operations to ensure legitimate rule management still works.

Typical attack path

1. Obtain local execution on a Linux host, container host, or workload with access to netfilter/ebtables administration interfaces.
2. Acquire or already possess CAP_NET_ADMIN in the relevant network namespace; this may be easier on systems allowing unprivileged user namespaces.
3. Use a 32-bit userspace execution path on a 64-bit kernel with CONFIG_COMPAT enabled.
4. Submit a crafted ebtables rule replacement or update containing an undersized match, watcher, or target structure.
5. Trigger the ebtables compatibility conversion path in compat_mtw_from_user().
6. Cause an out-of-bounds kernel read during extension-specific compat_from_user() processing.
7. Attempt to use the resulting kernel fault for denial of service, or investigate whether adjacent memory exposure is observable through the calling interface.

How to detect it

Look for evidence of attempted or successful malformed ebtables rule updates. Primary sources are kernel logs, systemd journal, auditd, endpoint telemetry, and container runtime logs. Kernel logs may show KASAN reports, slab out-of-bounds reads, kernel BUG/OOPS messages, call traces involving compat_mtw_from_user(), ebtables rule replacement, or netfilter setsockopt handling. Audit logs may show execution of ebtables or related tooling by unexpected users, from containers, or from 32-bit processes, especially when combined with CAP_NET_ADMIN activity or namespace creation. Container environments should correlate suspicious ebtables activity with privileged containers, CAP_NET_ADMIN grants, unprivileged user namespace creation, and recent workload compromise indicators. Because normal firewall and container networking software may legitimately manipulate ebtables, detections should prioritize unexpected initiators, repeated failures, kernel warnings, crashes, or rule updates immediately preceding instability.

• compat_mtw_from_user
• compat_from_user
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: KASAN
• kernel BUG at net/bridge/netfilter
• netfilter: ebtables
• ebt_do_replace
• do_ebt_set_ctl
• nf_setsockopt
• setsockopt
• ebtables
• ebtables-legacy
• ebtables-restore
• CAP_NET_ADMIN
• /sbin/ebtables
• /usr/sbin/ebtables
• /sbin/ebtables-legacy
• /usr/sbin/ebtables-legacy

What your security team should do

• Patch affected Linux kernels through the normal kernel maintenance process, prioritizing multi-tenant systems, container hosts, virtualization hosts, and systems where untrusted users can obtain network namespace privileges.
• Inventory systems with CONFIG_COMPAT/32-bit userspace support, ebtables or bridge netfilter use, and workloads granted CAP_NET_ADMIN.
• Disable or restrict unprivileged user namespaces where operationally feasible, especially on shared compute and container platforms.
• Remove CAP_NET_ADMIN from containers and service accounts unless explicitly required; avoid privileged containers.
• Monitor kernel logs for KASAN, OOPS, BUG, or panic messages involving ebtables, netfilter, compat_mtw_from_user(), or compat_from_user() callbacks.
• Review audit logs for unusual ebtables rule changes, especially from unexpected users, containers, or 32-bit processes.
• If ebtables is not required, block loading of ebtables/bridge netfilter modules using distribution-supported module denylisting controls.
• Treat exploitation evidence as a potential local compromise or container escape precursor and investigate the originating process, user, namespace, and workload.