The Linux kernel netfilter ebtables subsystem forwards a user supplied 32‑byte table name to a lock acquisition routine without ensuring the string is NUL terminated. When the table lookup fails, the code concatenates an unsafe string with the prefix "ebtable_" and passes it to vsnprintf. Because the string is not terminated, vsnprintf reads past the buffer, resulting in a stack out‑of‑bounds read. The subsequent call to request_module can load a kernel module whose name begins with the attacker‑controlled data, enabling the execution of arbitrary kernel code. The weakness is an instance of improper input validation that leads to a buffer overread (CWE‑125). The impact is the potential disclosure of kernel memory and privilege escalation to privileged code execution within the kernel context.

Any Linux kernel that includes the ebtables code before the commit that added proper NUL termination is affected. All Linux distributions that ship those kernel versions contain a vulnerable copy, regardless of distribution name.

The CVSS score of 7.1 indicates a moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to issue ebtables set‑options via setsockopt or a related ioctl; this privilege is normally available to local users or to remote users that can reach the target through a network interface. The likely attack vector is through a local or remote socket that can invoke the ebtables API, and the vulnerability can be leveraged to read kernel memory and load a malicious module, potentially resulting in kernel‑level code execution.