CVE-2026-53266

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An out-of-bounds write issue exists in the ebt snat tg() function within the net/bridge/netfilter/ebt snat.c module. The ebtables SNAT target, when configured to rewrite the hardware address in ARP packets using the --snat-arp option, writes data via skb store bits() without ensuring the memory region is writable. If the target range is held in a nonlinear skb fragment backed by a splice-imported file page, the system may copy the new MAC address directly into the frag page, corrupting memory outside the intended packet data. This issue has been actively exploited in the wild and can be triggered by a local attacker crafting packets traversing a bridge, potentially leading to a system crash or local privilege escalation.

Recommendations Update to a kernel version that includes the upstream fix. Disable ARP hardware-address rewriting in ebtables SNAT rules. Remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.