CVE-2026-53266 — Linux Vulnerability Details

What is CVE-2026-53266?

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

The record classifies CVE-2026-53266 under weakness class CWE-787. Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 111 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 8.8 — HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS (FIRST): 0.8% probability of exploitation in the next 30 days, higher than 56.2% of all scored CVEs
CISA KEV: Listed since 2026-09-18, federal remediation deadline 2026-09-21
Threadlinqs priority: 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
Published: 2026-06-25, last modified 2026-09-19

Is CVE-2026-53266 being exploited?

CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities catalog on 2026-09-18, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-09-21 under BOD 22-01. Weaponised exploit code for CVE-2026-53266 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.

suominen/CVE-2026-53266 (github)

Affected products and versions

Linux: Linux

How to fix CVE-2026-53266

Because CVE-2026-53266 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-09-21. No vendor patch reference has been recorded for CVE-2026-53266 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-53266

1 tracked threat in the Threadlinqs corpus references CVE-2026-53266, either in the campaign’s CVE list or as an indicator on the campaign record.

CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) — CRITICAL · 2026-09-19

Sources

Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

Other references

Showing 5 of 8 recorded references.