CVE-2026-53266

netfilter: bridge: make ebt_snat ARP rewrite writable

Exploited in the wild. In CISA KEV since 2026‑09‑18. A vendor fix is available.

CVSS 3.18.8High EPSS percentile49th0.6% chance in 30 days CISA KEVListedsince 2026-09-18, due 2026-09-21
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-25Updated 2026-09-19Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check each Linux server's running kernel version and whether it uses bridge ebtables SNAT rules that rewrite ARP addresses.
Install your Linux distributor's security kernel update containing the fix; upstream fixes are available in 5.5, 5.9, and 5.10.
If an update cannot be installed immediately, disable affected ebtables SNAT ARP-rewrite rules and restrict untrusted local user access.
Restart into the updated kernel and confirm the new version is running.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

In plain language

Written by AI from the record

CVE-2026-53266 is a serious Linux kernel flaw in systems missing the 5.5 or vendor-backported fix, and small businesses with affected servers should act urgently.

A local low-privileged attacker can exploit an out-of-bounds write (CWE-787) in Linux kernel bridge ebtables SNAT ARP rewriting, potentially escalating to full system compromise.

If you're affected

Full server takeover
Sensitive data exposure
Service outages
Ransomware risk

What is it

This is a mistake in the core software that runs Linux servers and devices. It can let someone with limited access alter protected computer memory, like a staff member finding a way to change settings on the building's master control panel.

Who is affected

This matters to you if you run Linux kernel on servers, appliances, virtual machines, or cloud workloads. It is especially relevant where bridge ebtables SNAT rules rewrite ARP addresses. It is only a risk if a low-privileged attacker can access the system and that traffic-rewrite path is used.

How urgent is it

Attackers are already exploiting this vulnerability, so treat it as a red, urgent remediation issue. CISA added it to its Known Exploited Vulnerabilities catalog on September 18, 2026, with a remediation due date of September 21, 2026.

What to do — in detail

Confirm the running kernel with uname -r, then inspect bridge ebtables configuration for SNAT rules that rewrite ARP sender hardware addresses. Obtain and deploy the security kernel package from your Linux distributor; upstream fixes are listed in 5.5, 5.9, and 5.10, and vendors may deliver the correction as a backport rather than those exact version labels. The findings do not map every listed commit to a specific stable branch, so verify the distributor advisory or package changelog includes CVE-2026-53266 or the relevant backport.

Kernel upgrades normally require a reboot into the new kernel; schedule that restart and verify the active version afterward. If patching is delayed, remove or disable affected ebtables SNAT ARP-rewrite rules where operationally possible, and limit untrusted local accounts or shell access. CISA's KEV due date is September 21, 2026. Until remediated, review changes to local accounts and bridge ebtables rules, and investigate unexpected privileged processes on affected hosts.

Technical context

Severity: CVSS 3.1 8.8 High (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The flaw is CWE-787, an out-of-bounds write in the netfilter bridge ebtables SNAT target's optional ARP sender hardware-address rewrite. The vulnerable path can write through skb_store_bits() without first ensuring the relevant ARP range is writable, including when data is held in a nonlinear fragment backed by a splice-imported file page. Exploitation is confirmed: CISA KEV listed the CVE on 2026-09-18. No public exploit code is on record. The EPSS prediction was flat, but confirmed exploitation supersedes that estimate.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Listed as exploited in the wild since 2026-09-18.

US federal agencies must remediate by 2026-09-21.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

14 events over 86 days, from the signal feeds we watch.

2026-09-19Patch availablerecord updated
2026-09-18Added to CISA KEVpatch available, patch available, record updated, record updated
2026-07-15OpenVAS check added
2026-07-08Patch availablerecord updated
2026-06-30Record updated
2026-06-25Publishedweakness classified, att&ck mapped

Affected products

Linuxoss-projectaka the linux kernel
- LinuxOSOn-premOperating Systems / linux-distro

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable