--- id: "CVE-2026-53266" kind: "vulnerability" aliases: ["CVE-2026-53266"] title: "In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite\u2026" severity: "high" cvss: 8.8 epss: null exploited: true status: "open" category: "runtime" products: [{"name": "Linux Kernel", "fixed": ["5.10.259", "5.15.210", "6.1.176", "6.6.143", "6.12.94", "6.18.36", "7.0.13", "7.1"], "affected": ">= 5.4.73 (stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.0 before fixes)", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.5"], "affected": ">= 5.4.73, < 5.5", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.9"], "affected": ">= 5.8.17, < 5.9", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.10.259"], "affected": ">= 5.9.2, < 5.10.259", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.210"], "affected": ">= 5.11, < 5.15.210", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.1.176"], "affected": ">= 5.16, < 6.1.176", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.6.143"], "affected": ">= 6.2, < 6.6.143", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.12.94"], "affected": ">= 6.7, < 6.12.94", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.18.36"], "affected": ">= 6.13, < 6.18.36", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["7.0.13"], "affected": ">= 6.19, < 7.0.13", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 7.1", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["bridge", "ebtables", "exploited", "kernel", "linux", "netfilter", "runtime", "self-hosted"] not_affected_if: ["managed-hosting", "no-bridge-netfilter", "no-ebtables-snat-rule"] published_at: "2026-06-25T09:16:44+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:37:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53266", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite… Out-of-bounds write in the Linux kernel's ebtables SNAT target (net/bridge/netfilter/ebt_snat.c). The optional ARP sender hardware address rewrite calls skb_store_bits() on a nonlinear skb fragment without making it writable. If the fragment is backed by a splice-imported file page, the new MAC address is written straight into that page. This allows local memory corruption and possible privilege escalation. It only applies to hosts with ebtables SNAT rules that use the ARP rewrite option on a bridge. CISA KEV lists it as exploited since 2026-09-18. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Linux Kernel affected >= 5.4.73 (stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.0 before fixes) fixed 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1 - vendor:linux kernel affected >= 5.4.73, < 5.5 fixed 5.5 - vendor:linux kernel affected >= 5.8.17, < 5.9 fixed 5.9 - vendor:linux kernel affected >= 5.9.2, < 5.10.259 fixed 5.10.259 - vendor:linux kernel affected >= 5.11, < 5.15.210 fixed 5.15.210 - vendor:linux kernel affected >= 5.16, < 6.1.176 fixed 6.1.176 - vendor:linux kernel affected >= 6.2, < 6.6.143 fixed 6.6.143 - vendor:linux kernel affected >= 6.7, < 6.12.94 fixed 6.12.94 - vendor:linux kernel affected >= 6.13, < 6.18.36 fixed 6.18.36 - vendor:linux kernel affected >= 6.19, < 7.0.13 fixed 7.0.13 - vendor:linux kernel affected = 7.1 fixed ? - vendor:Linux Kernel affected ? fixed ? ## How to check Run 'uname -r' and compare with the fixed versions (distro kernels backport, so check the distro's CVE page). Run 'ebtables -t nat -L' (or 'nft list ruleset' on nft-backed systems) and look for SNAT targets with the ARP rewrite option on bridge interfaces. If there are none, the vulnerable path is not used. Check 'lsmod' for ebt_snat. ## Fix Update to a kernel containing the fix: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or 7.1. Debian: bookworm 6.1.176-1 or later, trixie 6.12.94-1 or later (see tracker). RHEL 9 fix shipped in RHSA-2026:36645. Workaround: remove ebtables SNAT rules that rewrite ARP sender hardware addresses on bridges. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266 - 2026-10-23T21:37:05+00:00 analyst — Read kernel CNA announce (Greg KH, 2026-06-25), Red Hat, Armis, Debian tracker. Fixed versions per branch from CNA record. CAP_NET_ADMIN question unresolved: no source states it; Armis says local unprivileged (CVSS 8.8 PR:L) but configuring ebtables rules normally needs CAP_NET_ADMIN, possibly via user namespace. No PoC found; X has only ~2 posts, skipped. Severity high per Armis CVSS 8.8 plus KEV. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53266 ## Documents - [advisory] linux-cve-announce: CVE-2026-53266 netfilter: bridge: make ebt_snat ARP rewrite writable https://lists.openwall.net/linux-cve-announce/2026/06/25/123 - [describes] Armis CVE-2026-53266 https://cve.armis.com/CVE-2026-53266 - [fix] Debian tracker CVE-2026-53266 https://security-tracker.debian.org/tracker/CVE-2026-53266 - [mitigation] Red Hat CVE-2026-53266 https://access.redhat.com/security/cve/cve-2026-53266 ## From the sources In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_