Live › vulnerability › CVE-2026-53266
Go to dashboardOut-of-bounds write in the Linux kernel's ebtables SNAT target (net/bridge/netfilter/ebt_snat.c). The optional ARP sender hardware address rewrite calls skb_store_bits() on a nonlinear skb fragment without making it writable. If the fragment is backed by a splice-imported file page, the new MAC address is written straight into that page. This allows local memory corruption and possible privilege escalation. It only applies to hosts with ebtables SNAT rules that use the ARP rewrite option on a bridge. CISA KEV lists it as exploited since 2026-09-18.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Linux Kernel | vendor | >= 5.4.73 (stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.0 before fixes) | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1 |
| linux kernel | vendor | >= 5.4.73, < 5.5 | 5.5 |
| linux kernel | vendor | >= 5.8.17, < 5.9 | 5.9 |
| linux kernel | vendor |
| >= 5.9.2, < 5.10.259 |
| 5.10.259 |
| linux kernel | vendor | >= 5.11, < 5.15.210 | 5.15.210 |
| linux kernel | vendor | >= 5.16, < 6.1.176 | 6.1.176 |
| linux kernel | vendor | >= 6.2, < 6.6.143 | 6.6.143 |
| linux kernel | vendor | >= 6.7, < 6.12.94 | 6.12.94 |
| linux kernel | vendor | >= 6.13, < 6.18.36 | 6.18.36 |
| linux kernel | vendor | >= 6.19, < 7.0.13 | 7.0.13 |
| linux kernel | vendor | = 7.1 | – |
| Linux Kernel | vendor | – | – |
uname -r and compare with the fixed versions (distro kernels backport, so check the distro's CVE page)ebtables -t nat -L (or nft list ruleset on nft-backed systems) and look for SNAT targets with the ARP rewrite option on bridge interfaceslsmod for ebt_snat5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or 7.16.1.176-1 or later, trixie 6.12.94-1 or later (see tracker)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data:
skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)
skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it.
Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
This page as .md · .json · in your agent: get_signal("CVE-2026-53266")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.