CVE-2026-53266

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter bridge ebtables SNAT target regarding how the ARP sender hardware address rewrite is handled. While the Ethernet source address rewrite is managed via skb ensure writable(skb, 0), the ARP rewrite uses skb store bits() at an offset relative to skb->data. Because skb header pointer() only ensures the ARP header is readable and not writable, if the sender hardware address range is held in a nonlinear skb fragment backed by a splice-imported file page, skb store bits() may copy the new MAC address directly into the frag page. This occurs during the execution of the skb store bits() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.