Vulnerability record · CVE-2026-53266 · published 25 June 2026
CVE-2026-53266: Linux kernel ebtables SNAT out-of-bounds write in ARP rewrite
Linux · Linux Kernel
The ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA bytes live in a nonlinear skb fragment backed by a splice-imported file page, the kernel maps the frag page and copies the new MAC address directly into it, corrupting memory outside the intended buffer. The flaw is an out-of-bounds write in the Linux kernel netfilter bridge code.
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is a high-severity kernel out-of-bounds write with high C/I/A impact and is listed in CISA KEV as exploited, though it requires local low-privileged access and EPSS is low.
What it is
The ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA bytes live in a nonlinear skb fragment backed by a splice-imported file page, the kernel maps the frag page and copies the new MAC address directly into it, corrupting memory outside the intended buffer. The flaw is an out-of-bounds write in the Linux kernel netfilter bridge code.
Impact
An attacker gains a controlled out-of-bounds write into a page-backed skb fragment, which can corrupt kernel or file-backed memory and potentially lead to privilege escalation or code execution in the kernel context. The CVSS vector rates confidentiality, integrity and availability impact as high with scope change.
Attack surface
The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker needs local access and the ability to trigger the ebtables SNAT ARP rewrite path, typically by sending crafted traffic through a bridge configured with the SNAT target. No remote unauthenticated path is described in the record.
Exploitation
CVE-2026-53266 is listed in CISA KEV with a due date of 2026-09-21, indicating known exploitation, though no ransomware campaign use is documented. EPSS is low at 0.00121 (2.19th percentile), and all references are patches or the KEV entry, with no public exploit tags.
What to do
- Apply the upstream stable kernel patches referenced in the git.kernel.org links for your kernel branch.
- If patching is not immediately possible, disable or avoid ebtables SNAT ARP sender hardware address rewriting on bridge interfaces.
- Restrict local access and untrusted workloads on hosts that use bridge netfilter/ebtables SNAT rules.
- Follow CISA BOD 26-04 guidance and the KEV required action, including evaluating internet exposure and discontinuing use if mitigations are unavailable.
Detection
- Monitor for kernel crashes, oopses or memory corruption reports in dmesg/syslog tied to netfilter bridge or ebtables SNAT paths.
- Audit bridge and ebtables configurations for SNAT rules that rewrite ARP sender hardware addresses.
- Track local privilege escalation attempts or unusual kernel memory writes on hosts running bridge netfilter with ebtables SNAT.
- Alert on unexpected modifications to file-backed pages or splice-related activity correlated with bridge traffic.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities catalog on 18 September 2026 as "Linux Kernel Out-of-Bounds Write Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 21 September 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2026-53266 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-53266), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
