CVE-2026-53266: Linux Kernel

What is CVE-2026-53266?

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

CVSS8.8 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS<1% · P2

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWECWE-787

NVD published2026-06-25

NVD last modified2026-09-19

Timeline

2026-06-25Published to the U.S. National Vulnerability Database (NVD)
2026-09-18Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-09-19NVD record last updated
2026-09-21CISA federal remediation deadline (BOD 22-01)

CISA Known Exploited Vulnerability

Linux Kernel Out-of-Bounds Write Vulnerability

Added to KEV2026-09-18

Federal patch deadline2026-09-21

Known ransomware useUnknown

Affected product

Linux Kernel

Remediation Steps

Apply the vendor security update for Linux Kernel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of September 2026 (September 14 – 20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.