A high-severity vulnerability in the Linux kernel netfilter subsystem potentially allows local attackers to cause information disclosure or denial of service.

This flaw exists within the ebtables module where improper handling of string lengths can lead to non-null terminated strings being passed to the request_module function. An authenticated local attacker with low privileges can exploit this to trigger memory corruption, resulting in information disclosure or system instability.

The vulnerability carries a CVSS score of 7.1, reflecting a significant risk to system integrity and availability. Because it permits a local attacker to potentially leak sensitive kernel memory or crash the system, it poses a direct threat to the uptime and security of hosted services. In environments where local access is provided to untrusted users or containers, this vulnerability could be leveraged to escalate local impact significantly.

Immediate Action: Update the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later, depending on the specific branch in use.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system reboots that may indicate exploitation attempts against the netfilter subsystem.

Compensating Controls: Restrict access to ebtables and related netfilter configuration commands to administrative users only, effectively limiting the attack surface for local users.

Public Exploit Available: No

Given the critical nature of kernel-level vulnerabilities, administrators should prioritize patching their Linux distributions as soon as upstream stable releases become available. While the attack requires local access, the potential for kernel-level impact warrants immediate attention to prevent unauthorized information access or system disruption.