CVE-2026-53266: Linux Kernel ebtables SNAT Out-of-Bounds Write (KEV)

CVE-2026-53266 is an out-of-bounds write in the Linux kernel's ebtables SNAT target: a local attacker who can get a bridge host to apply an ebtables SNAT rule with the optional ARP-rewrite option to spliced, file-backed socket-buffer fragments can make the kernel write memory it should not reach, and CISA added it to the KEV catalog with a 3-day remediation window and an explicit note that affected branches may already be end-of-life.

CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target. NVD's description, carried verbatim from the upstream kernel.org fix commit, explains the exact mechanism: the ebtables SNAT target's optional ARP sender-hardware-address rewrite "writes through skb_store_bits() at an offset relative to skb->data", but "skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it" (NVD).

This CVE is assigned directly by the upstream Linux kernel CNA (kernel.org), which NVD stores as a Secondary (not NVD Primary) CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — a local attack vector requiring only low privileges, with a changed scope reflecting that the memory corruption can affect resources beyond the ebtables component itself (NVD).

The fix was backported as eight separate stable-branch commits published directly on git.kernel.org, which match the affected ranges NVD records: 5.4.73 and later 5.4.x builds, 5.8.17 and later 5.8.x builds, 5.9.2 through 5.10.258 (fixed in 5.10.259), 5.11 through 5.15.209 (fixed in 5.15.210), 5.16 through 6.1.175 (fixed in 6.1.176), 6.2 through 6.6.142 (fixed in 6.6.143), 6.7 through 6.12.93 (fixed in 6.12.94), 6.13 through 6.18.35 (fixed in 6.18.36), and 6.19 through 7.0.12 (fixed in 7.0.13); NVD also lists the then-unreleased 7.1 release-candidate builds rc1 through rc6 as affected (git.kernel.org stable fix).

CISA added CVE-2026-53266 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-18, with a required-action due date of just 2026-09-21 (3 days), and explicitly flags that "the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS)" for some of the branches above, advising that EoL/EoS kernels be migrated to a supported version rather than merely patched (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0093 (60.575th percentile) — moderate, reflecting that exploitation requires the ability to configure or influence an ebtables SNAT rule with ARP-rewrite on a bridge host, rather than being reachable without any local setup (FIRST EPSS).

Because this bug sits in the bridging/netfilter path of the kernel itself, any Linux system that applies ebtables SNAT rules with the ARP-rewrite option — common on bridge-based network appliances and container or VM hosts — should be updated to a kernel at or above the fixed version for its branch, or migrated off an EoL branch entirely.

• Out-of-bounds write (CWE-787): the ebtables SNAT target's ARP sender-hardware-address rewrite writes via skb_store_bits() into a range that skb_header_pointer() never made writable, corrupting a spliced file-backed skb fragment page. — NVD
• CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, assigned directly by the Linux kernel CNA (kernel.org) and stored by NVD as a Secondary metric. — NVD
• Fix backported across nine stable branches (5.4.x, 5.8.x, 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13) as eight distinct commits published on git.kernel.org; 7.1-rc1 through rc6 also listed as affected. — kernel.org
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-18, required action due 2026-09-21; CISA notes some impacted branches could be end-of-life/end-of-service. — CISA KEV
• EPSS score is 0.0093 (60.575th percentile) as of 2026-10-27. — FIRST EPSS