Linux Kernel Out-of-Bounds Write Vulnerability

🚨SEVERITY: HIGH — CVSS 8.8Security Advisory

TL;DR 📌

  • Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported…
  • Highest CVSS: 8.8 (High).
  • Listed in CISA KEV (2026-09-18) — this is being exploited in the wild.
  • Fixed in 5.10.259, 5.15.210, 5.5, 5.9 — upgrade to this release or later.
  • CVEs: CVE-2026-53266.

What it is

CVE-2026-53266 is an out-of-bounds write in the Linux kernel’s netfilter bridge code, specifically in the ebtables SNAT target’s optional ARP sender hardware address (SHA) rewrite.

The ebtables SNAT target normally guards its Ethernet source address rewrite with skb_ensure_writable(skb, 0), which is deliberate: at the bridge ebtables hooks, the Ethernet header is addressed via skb_mac_header()/eth_hdr(), while skb->data points at the payload. The ARP SHA rewrite is different — it writes through skb_store_bits() at an offset relative to skb->data. The problem is that skb_header_pointer() only validates that the ARP header itself is safely readable; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the fragment page and copies the new MAC address directly into it — an out-of-bounds write into memory that was not prepared for modification.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates local access with low attack complexity, requiring low privileges and no user interaction. The scope change and high confidentiality/integrity/availability impact reflect that a successful write can corrupt kernel memory beyond the intended buffer. Reaching this code path requires an ebtables configuration using the SNAT target with the ARP SHA rewrite option, on a bridge interface, and a packet path where the ARP header ends up in a nonlinear skb fragment sourced from a spliced file page.

The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalogue, added 18 September 2026.

What to do

  • Update the kernel to one of the fixed versions: 5.5, 5.9, 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13, matching whichever branch you track.
  • If you run ebtables with the SNAT target’s ARP sender hardware address rewrite on any bridge interface, treat this as a priority patch given its KEV listing — check current kernel version against the fixed list above before anything else.
  • Where patching cannot happen immediately, review whether the ARP SHA rewrite option is actually in use in your ebtables rules; removing it removes the code path, though this is a workaround, not a fix.
  • If running an end-of-life or end-of-service kernel branch not covered by the fixed versions listed, plan migration to a supported release — the advisory notes affected products may be EoL/EoS and recommends discontinuing use of unsupported versions.
  • Consult the advisory at the NVD entry for CVE-2026-53266 for any updates to the fixed version list.

For leadership 🧭

Executive summary. This is a Linux kernel flaw affecting bridges that use ebtables SNAT with the ARP sender hardware address rewrite option, and it’s already in CISA’s Known Exploited Vulnerabilities list, so it needs to be treated as an active risk rather than a theoretical one. Kernel corruption from this path can affect confidentiality, integrity and availability, so patching should happen in the next scheduled window, sooner if the ARP rewrite option is confirmed in use.

Why it matters:

  • The flaw sits in the ebtables SNAT target’s optional ARP sender hardware address rewrite, a feature only triggered when that specific rule option is configured on a bridge interface.
  • skb_store_bits() can write the new MAC address directly into a nonlinear fragment backed by a spliced file page that was never marked writable, corrupting kernel memory beyond the intended buffer.
  • The scope-change and high C/I/A impact in the CVSS vector mean a successful write is not confined to the packet buffer – it can affect other kernel state.
  • This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue (added 18 September 2026), so exploitation is already documented rather than hypothetical.

Now / Next / Later:

  • Now: Check whether any bridge hosts run ebtables with the SNAT target’s ARP sender hardware address rewrite option enabled, and check their kernel version against the fixed list.
  • Next: Patch affected kernels to the relevant fixed version (5.5, 5.9, 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13) in the next change window, prioritising hosts confirmed to use the ARP SHA rewrite.
  • Later: Where patching is delayed, remove the ARP SHA rewrite option from ebtables rules as an interim workaround, and plan migration off any end-of-life or end-of-service kernel branches not covered by the fixed versions.

Source