CVE Details

CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability
Published: 2026-09-18 CVSS: 8.8 HIGH Product: Linux Kernel Due Date: 2026-09-21

Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 8.8
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-53266
cveMetadata > assignerOrgId 416baaa9-dc9f-4396-8d5f-8c081fb06d67
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName Linux
cveMetadata > dateReserved 2026-06-09T07:44:35.395Z
cveMetadata > datePublished 2026-06-25T08:39:53.190Z
cveMetadata > dateUpdated 2026-09-18T14:41:56.688Z
containers > cna > providerMetadata > orgId 416baaa9-dc9f-4396-8d5f-8c081fb06d67
containers > cna > providerMetadata > shortName Linux
containers > cna > providerMetadata > dateUpdated 2026-08-05T12:34:43.383Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > baseScore 8.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value AV:L - Exploitation requires local control of bridge/ebtables configuration and arranging an skb with shared non-linear backing memory; remote ARP traffic alone cannot create the splice-backed page condition. AC:L - There is no race or rare external timing condition; the attacker can control the rule, ARP frame layout, and shared-frag setup needed to reach the write. PR:L - The ebtables rule path requires CAP_NET_ADMIN, but this is reachable with namespace-local privileges via user/network namespaces rather than requiring init-namespace root. UI:N - No victim action is required once the attacker can configure the namespace and send the crafted traffic through the bridge path. S:C - The bug can let namespace-local network privileges corrupt file-backed/page-cache memory outside the bridge/netfilter security boundary, plausibly crossing a sandbox or namespace boundary. C:H - The shared-page corruption can be leveraged toward privilege escalation or code execution, which can expose high-value system data. I:H - skb_store_bits() writes attacker-chosen MAC bytes into shared backing pages, giving a controlled corruption primitive against file-backed memory. A:H - Controlled corruption of shared/file-backed pages can damage critical files or executable contents and can be repeated to cause severe system availability impact.
containers > cna > affected > 0 > product Linux
containers > cna > affected > 0 > vendor Linux
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > repo https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
containers > cna > affected > 0 > programFiles > 0 net/bridge/netfilter/ebt_snat.c
containers > cna > affected > 0 > versions > 0 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 0 > lessThan bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > versionType git
containers > cna > affected > 0 > versions > 1 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 1 > lessThan 76280b78cc9f23bdc6438e10ad6dff148ef8375b
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > versionType git
containers > cna > affected > 0 > versions > 2 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 2 > lessThan b7e91939ba9be805a62a257fa4e227dffbb88fa0
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > versionType git
containers > cna > affected > 0 > versions > 3 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 3 > lessThan afd64b59c3de9bbbdd3759e834fdc55cda716e0b
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > versionType git
containers > cna > affected > 0 > versions > 4 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 4 > lessThan 153ea96c806aea395daba907a4f88480b6ad5093
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > affected > 0 > versions > 4 > versionType git
containers > cna > affected > 0 > versions > 5 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 5 > lessThan b18675263db1147c8e1cab625400c13a0d87bd2d
containers > cna > affected > 0 > versions > 5 > status affected
containers > cna > affected > 0 > versions > 5 > versionType git
containers > cna > affected > 0 > versions > 6 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 6 > lessThan c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5
containers > cna > affected > 0 > versions > 6 > status affected
containers > cna > affected > 0 > versions > 6 > versionType git
containers > cna > affected > 0 > versions > 7 > version 63137bc5882a1882c553d389fdeeeace86ee1741
containers > cna > affected > 0 > versions > 7 > lessThan 67ba971ae02514d85818fe0c32549ab4bfa3bf49
containers > cna > affected > 0 > versions > 7 > status affected
containers > cna > affected > 0 > versions > 7 > versionType git
containers > cna > affected > 0 > versions > 8 > version 2f3839075a5f8dcf116c1abe35b36b018ac62445
containers > cna > affected > 0 > versions > 8 > status affected
containers > cna > affected > 0 > versions > 8 > versionType git
containers > cna > affected > 0 > versions > 9 > version 51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b
containers > cna > affected > 0 > versions > 9 > status affected
containers > cna > affected > 0 > versions > 9 > versionType git
containers > cna > affected > 0 > versions > 10 > version b7d23c2c87584eb429f115c078ed511be8b18e29
containers > cna > affected > 0 > versions > 10 > status affected
containers > cna > affected > 0 > versions > 10 > versionType git
containers > cna > affected > 0 > versions > 11 > version 5.4.73
containers > cna > affected > 0 > versions > 11 > lessThan 5.5
containers > cna > affected > 0 > versions > 11 > status affected
containers > cna > affected > 0 > versions > 11 > versionType semver
containers > cna > affected > 0 > versions > 12 > version 5.8.17
containers > cna > affected > 0 > versions > 12 > lessThan 5.9
containers > cna > affected > 0 > versions > 12 > status affected
containers > cna > affected > 0 > versions > 12 > versionType semver
containers > cna > affected > 0 > versions > 13 > version 5.9.2
containers > cna > affected > 0 > versions > 13 > lessThan 5.10
containers > cna > affected > 0 > versions > 13 > status affected
containers > cna > affected > 0 > versions > 13 > versionType semver
containers > cna > affected > 1 > product Linux
containers > cna > affected > 1 > vendor Linux
containers > cna > affected > 1 > defaultStatus affected
containers > cna > affected > 1 > repo https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
containers > cna > affected > 1 > programFiles > 0 net/bridge/netfilter/ebt_snat.c
containers > cna > affected > 1 > versions > 0 > version 5.10
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 1 > version 0
containers > cna > affected > 1 > versions > 1 > lessThan 5.10
containers > cna > affected > 1 > versions > 1 > status unaffected
containers > cna > affected > 1 > versions > 1 > versionType semver
containers > cna > affected > 1 > versions > 2 > version 5.10.259
containers > cna > affected > 1 > versions > 2 > lessThanOrEqual 5.10.*
containers > cna > affected > 1 > versions > 2 > status unaffected
containers > cna > affected > 1 > versions > 2 > versionType semver
containers > cna > affected > 1 > versions > 3 > version 5.15.210
containers > cna > affected > 1 > versions > 3 > lessThanOrEqual 5.15.*
containers > cna > affected > 1 > versions > 3 > status unaffected
containers > cna > affected > 1 > versions > 3 > versionType semver
containers > cna > affected > 1 > versions > 4 > version 6.1.176
containers > cna > affected > 1 > versions > 4 > lessThanOrEqual 6.1.*
containers > cna > affected > 1 > versions > 4 > status unaffected
containers > cna > affected > 1 > versions > 4 > versionType semver
containers > cna > affected > 1 > versions > 5 > version 6.6.143
containers > cna > affected > 1 > versions > 5 > lessThanOrEqual 6.6.*
containers > cna > affected > 1 > versions > 5 > status unaffected
containers > cna > affected > 1 > versions > 5 > versionType semver
containers > cna > affected > 1 > versions > 6 > version 6.12.94
containers > cna > affected > 1 > versions > 6 > lessThanOrEqual 6.12.*
containers > cna > affected > 1 > versions > 6 > status unaffected
containers > cna > affected > 1 > versions > 6 > versionType semver
containers > cna > affected > 1 > versions > 7 > version 6.18.36
containers > cna > affected > 1 > versions > 7 > lessThanOrEqual 6.18.*
containers > cna > affected > 1 > versions > 7 > status unaffected
containers > cna > affected > 1 > versions > 7 > versionType semver
containers > cna > affected > 1 > versions > 8 > version 7.0.13
containers > cna > affected > 1 > versions > 8 > lessThanOrEqual 7.0.*
containers > cna > affected > 1 > versions > 8 > status unaffected
containers > cna > affected > 1 > versions > 8 > versionType semver
containers > cna > affected > 1 > versions > 9 > version 7.1
containers > cna > affected > 1 > versions > 9 > lessThanOrEqual *
containers > cna > affected > 1 > versions > 9 > status unaffected
containers > cna > affected > 1 > versions > 9 > versionType original_commit_for_fix
containers > cna > cpeApplicability > 0 > nodes > 0 > operator OR
containers > cna > cpeApplicability > 0 > nodes > 0 > negate False
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding 5.10.259
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding 5.15.210
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding 6.1.176
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionEndExcluding 6.6.143
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionEndExcluding 6.12.94
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionEndExcluding 6.18.36
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionEndExcluding 7.0.13
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > versionStartIncluding 5.10
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > versionEndExcluding 7.1
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > versionStartIncluding 5.4.73
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > versionStartIncluding 5.8.17
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > versionStartIncluding 5.9.2
containers > cna > references > 0 > url https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
containers > cna > references > 1 > url https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b
containers > cna > references > 2 > url https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0
containers > cna > references > 3 > url https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b
containers > cna > references > 4 > url https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093
containers > cna > references > 5 > url https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d
containers > cna > references > 6 > url https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5
containers > cna > references > 7 > url https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49
containers > cna > title netfilter: bridge: make ebt_snat ARP rewrite writable
containers > cna > x_generator > engine bippy-1.2.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-53266
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-18T14:40:13.592810Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > lang en
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > type CWE
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > cweId CWE-787
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > description CWE-787 Out-of-bounds Write
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-18T14:41:56.688Z