The kernel’s ebtables module contains a flaw in the chainstack allocation loop. When cpu_possible_mask is sparse, the loop skips CPUs that are not present, leaving a chainstack entry uninitialized. If a later allocation fails, the cleanup routine mistakenly frees the uninitialized address, corrupting kernel memory. This flaw is characterized by an uninitialized memory free, classified under CWE‑824, and could allow a local attacker to crash the system or execute arbitrary code within kernel mode.

All Linux kernel releases that include the netfilter ebtables component and support sparse CPU masks are affected. The precise kernel versions are not enumerated in the advisory; the issue existed before the commit that added proper bounds checking and cleanup.

The CVSS score of 7.0 indicates high severity, and the EPSS score is less than 1 %, while the vulnerability is not listed in the CISA KEV catalog, suggesting a low exploitation probability. The attack vector is most likely local: an attacker with kernel or root privileges may configure ebtables to exercise the defective path or exploit the flaw after an unlikely allocation failure, and the risk remains largely hypothetical until a patch is applied.