{"id":"CVE-2026-53266","kind":"vulnerability","aliases":["CVE-2026-53266"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable.  If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().","summary":"Out-of-bounds write in the Linux kernel's ebtables SNAT target (net/bridge/netfilter/ebt_snat.c). The optional ARP sender hardware address rewrite calls skb_store_bits() on a nonlinear skb fragment without making it writable. If the fragment is backed by a splice-imported file page, the new MAC address is written straight into that page. This allows local memory corruption and possible privilege escalation. It only applies to hosts with ebtables SNAT rules that use the ARP rewrite option on a bridge. CISA KEV lists it as exploited since 2026-09-18.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-18T00:00:00+00:00","products":[{"name":"Linux Kernel","fixed":["5.10.259","5.15.210","6.1.176","6.6.143","6.12.94","6.18.36","7.0.13","7.1"],"affected":">= 5.4.73 (stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.0 before fixes)","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.5"],"affected":">= 5.4.73, < 5.5","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.9"],"affected":">= 5.8.17, < 5.9","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.259"],"affected":">= 5.9.2, < 5.10.259","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.210"],"affected":">= 5.11, < 5.15.210","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.176"],"affected":">= 5.16, < 6.1.176","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.143"],"affected":">= 6.2, < 6.6.143","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.12.94"],"affected":">= 6.7, < 6.12.94","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.18.36"],"affected":">= 6.13, < 6.18.36","ecosystem":"vendor"},{"name":"linux kernel","fixed":["7.0.13"],"affected":">= 6.19, < 7.0.13","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 7.1","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bridge","ebtables","exploited","kernel","linux","netfilter","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-bridge-netfilter","no-ebtables-snat-rule"],"how_to_check":"Run 'uname -r' and compare with the fixed versions (distro kernels backport, so check the distro's CVE page). Run 'ebtables -t nat -L' (or 'nft list ruleset' on nft-backed systems) and look for SNAT targets with the ARP rewrite option on bridge interfaces. If there are none, the vulnerable path is not used. Check 'lsmod' for ebt_snat.","fix":"Update to a kernel containing the fix: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or 7.1. Debian: bookworm 6.1.176-1 or later, trixie 6.12.94-1 or later (see tracker). RHEL 9 fix shipped in RHSA-2026:36645. Workaround: remove ebtables SNAT rules that rewrite ARP sender hardware addresses on bridges.","status":"open","published_at":"2026-06-25T09:16:44+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:29:48+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T20:29:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"An out-of-bounds write in the Linux kernel's ebtables SNAT target lets an ARP sender rewrite the hardware address into a splice-imported file page, which can corrupt file-backed memory. CISA reports active exploitation, so an attacker who can send crafted ARP traffic on a host with this rule may gain write access to data the kernel should not let them modify.","category":"runtime","who_cares":["linux","kernel","self-hosted","ebtables"],"confidence":0.5,"analyst_note":"Sources give no fixed kernel versions or config check; find the upstream fix commit and affected version range from the kernel CVE record and distro advisories, and confirm whether the vulnerable path needs CAP_NET_ADMIN to configure ebtables SNAT.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ebtables-snat-rule","managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000396,"input_tokens":2277,"output_tokens":336,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources give no fixed kernel versions or config check; find the upstream fix commit and affected version range from the kernel CVE record and distro advisories, and confirm whether the vulnerable path needs CAP_NET_ADMIN to configure ebtables SNAT.","search":"'-09':149B '-18':150B '-2026':19A,22A '-53266':20A,23A '/eth_hdr':202C '0':184C '2026':148B '63137bc5882a':237C 'address':77B,107B,177C,197C,244C,289C,323C 'alen':271C 'allow':115B 'appli':125B 'arp':16A,74B,135B,166C,241C,279C,329C,337C 'arphdr':267C 'ask':211C 'back':96B,303C 'behind':179C 'bit':82B,253C,263C,313C,344C 'bound':61B 'bridg':12A,48B,140B,162C,190C 'byte':218C 'call':79B,341C 'check':220C 'cisa':141B 'commit':236C 'copi':319C 'corrupt':118B 'cve':18A,21A 'data':205C,260C 'differ':247C 'direct':324C 'ebt':14A,164C 'ebtabl':49B,68B,129B,170C,191C 'ensur':181C,213C,327C 'escal':122B 'eth':216C,270C 'ethernet':175C,194C,209C,225C 'exploit':50B,146B 'file':102B,309C 'fix':234C 'follow':6A,156C 'frag':316C 'fragment':87B,94B,302C 'hardwar':76B,243C,288C 'header':195C,201C,226C,273C,280C,338C 'held':297C 'hlen':217C 'hook':192C 'host':57B,127B 'howev':238C 'import':101B,308C 'info':268C 'intent':187C 'keep':173C 'kernel':4A,25A,27A,29A,31A,33A,35A,37A,39A,41A,43A,45A,47A,51B,66B,154C 'kev':142B 'later':286C 'linux':3A,24A,26A,28A,30A,32A,34A,36A,38A,40A,42A,44A,46A,52B,65B,153C 'list':143B 'local':116B 'mac':106B,200C,269C,322C 'make':13A,89B,163C,284C 'map':314C 'memori':117B 'net/bridge/netfilter/ebt_snat.c':71B 'netfilt':11A,53B,161C 'new':105B,321C 'nonlinear':85B,300C 'offset':256C 'option':73B,137B,240C 'out-of-bound':58B 'packet':232C 'page':103B,113B,310C,317C 'payload':210C,222C 'point':206C 'pointer':274C 'possibl':120B 'privileg':121B 'rang':290C,294C,331C 'read':277C,335C 'regress':233C 'reintroduc':229C 'relat':257C 'resolv':10A,160C 'rewrit':17A,78B,136B,167C,178C,245C 'rule':131B 'runtim':54B 'safe':276C 'self':56B 'self-host':55B 'sender':75B,242C,287C 'sha':330C 'sinc':147B 'sizeof':265C 'skb':80B,86B,180C,183C,199C,204C,212C,251C,259C,261C,264C,272C,301C,311C,342C 'small':231C 'snat':15A,69B,130B,165C,171C 'sourc':176C 'splice':100B,307C 'splice-import':99B,306C 'still':296C 'store':81B,252C,262C,312C,343C 'straight':110B 'struct':266C 'target':70B,172C 'use':133B 'vulner':7A,157C 'without':88B 'would':219C,228C 'writabl':91B,168C,182C,214C,291C,333C 'write':62B,249C 'written':109B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-25T09:16:44+00:00","kev":{"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-53266","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266","severity":null,"published_at":"2026-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-53266:116","url":null,"severity":null,"published_at":"2026-10-23T21:37:05+00:00","modified_at":"2026-10-23T21:37:05+00:00","first_seen_at":"2026-10-23T21:37:05+00:00","fetched_at":"2026-10-23T21:37:05+00:00","note":"Read kernel CNA announce (Greg KH, 2026-06-25), Red Hat, Armis, Debian tracker. Fixed versions per branch from CNA record. CAP_NET_ADMIN question unresolved: no source states it; Armis says local unprivileged (CVSS 8.8 PR:L) but configuring ebtables rules normally needs CAP_NET_ADMIN, possibly via user namespace. No PoC found; X has only ~2 posts, skipped. Severity high per Armis CVSS 8.8 plus KEV."},{"source":"nvd","external_id":"CVE-2026-53266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53266","severity":null,"published_at":"2026-06-25T09:16:44+00:00","modified_at":"2026-09-19T04:17:53+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1132,"url":"https://lists.openwall.net/linux-cve-announce/2026/06/25/123","title":"linux-cve-announce: CVE-2026-53266 netfilter: bridge: make ebt_snat ARP rewrite writable","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1134,"url":"https://access.redhat.com/security/cve/cve-2026-53266","title":"Red Hat CVE-2026-53266","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1136,"url":"https://cve.armis.com/CVE-2026-53266","title":"Armis CVE-2026-53266","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1138,"url":"https://security-tracker.debian.org/tracker/CVE-2026-53266","title":"Debian tracker CVE-2026-53266","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}