Linux Kernel EUVD-2026-45650

Exploitation requires local code execution on the target and the ability to manipulate ebtables tables, which in practice means holding CAP_NET_ADMIN - either as root/network admin on the host or within a user+network namespace where the capability is delegated (a common container scenario). The attacker must trigger concurrent ebtables table registration and removal to hit the race window where table->ops is not yet assigned; this is a timing-dependent condition, so success is probabilistic rather than guaranteed. Limiting factors: no remote vector (AV:L), no unauthenticated path (PR:L implies some privilege/capability, per the CVSS vector), the ebtables/bridge-netfilter code path must be reachable (module loaded / bridge filtering in use), and only kernels between roughly 5.15 and the fixed 6.18.34/7.0.11/7.1 builds are affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) indicates a local, low-privilege attacker can achieve high confidentiality, integrity and availability impact. However, several signals temper real-world urgency: EPSS is only 0.17% (6th percentile), the bug is NOT in CISA KEV, and no POC is referenced - so there is no evidence of active or imminent exploitation. There is also a mild internal tension worth verifying: the feed rates AC:L, but the patch describes a removal-time race that in practice usually requires winning a timing window (arguably AC:H), and it tags the issue 'Information Disclosure' while the CVSS claims full I:H/A:H - real impact may be narrower than the score suggests. Manipulating ebtables generally requires CAP_NET_ADMIN, which aligns with PR:L (not PR:N). Net assessment: a legitimate defense-in-depth kernel fix to patch on normal cycles, but not an emergency; the high CVSS reflects worst-case memory-corruption potential, not demonstrated widespread exploitability.

A local user (or a process inside a container granted CAP_NET_ADMIN in its network namespace) rapidly registers and tears down ebtables tables while concurrently accessing them, racing to observe an ebt_table struct before its ops pointer is set. Hitting that window lets the attacker read uninitialized kernel memory or dereference a partial structure, potentially escalating to code execution or leaking sensitive kernel data. No public POC is currently referenced, and success depends on winning a narrow timing race.