CVE-2026-53266: Linux kernel ebtables SNAT ARP rewrite writes into file-backed pages

Exploited in the wild High 8.8 EPSS 0.9% Linux kernel

The ebtables SNAT target for bridges (net/bridge/netfilter/ebt_snat.c) rewrites the ARP sender hardware address with skb_store_bits() without first making that part of the packet writable. If those bytes sit in a socket-buffer fragment backed by a file page imported with splice(), the new MAC address is written straight into the file's page. Red Hat rates it Important: a local attacker on a host with ebtables SNAT rules that rewrite ARP can corrupt memory or escalate privileges. CISA added it to KEV on 18 September 2026; the CVE record lists no fix for the 5.4 series.

• CVE-2026-53266CVE identifier
• 8.8CVSS 3.1 base score (high)
• 2026-09-18added to CISA's exploited list (US federal deadline 2026-09-21)
• 0.9%EPSS: chance of exploitation in the next 30 days (higher than 61% of CVEs)
• 2026-06-25published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 5.4.73 through 5.4.x (no 5.4 fix)
• Linux 5.8.17 through 5.8.x
• Linux 5.9.2 through 5.10.258
• Linux 5.11 through 5.15.209
• Linux 5.16 through 6.1.175
• Linux 6.2 through 6.6.142
• Linux 6.7 through 6.12.93
• Linux 6.13 through 6.18.35
• Linux 6.19 through 7.0.12

Fixed in:

• Linux 5.10.259
• Linux 5.15.210
• Linux 6.1.176
• Linux 6.6.143
• Linux 6.12.94
• Linux 6.18.36
• Linux 7.0.13
• Linux 7.1

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)
sudo ebtables -t nat -L | grep -i snat   # exposure needs ebtables SNAT rules that rewrite ARP

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot

sudo apt update
sudo apt upgrade
sudo reboot
# As of 3 Nov 2026 Ubuntu lists 20.04 GA (5.4) and 24.04 HWE 6.17 as 'needed' and 22.04 HWE 6.8 as 'pending'.

sudo dnf upgrade kernel
sudo reboot
# RHEL 7: sudo yum update kernel
# no-reboot option where Red Hat ships kpatch for your stream (see restart):
# sudo dnf install "kpatch-patch = $(uname -r)"

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2: default kernel not affected; kernel-5.4 extra is 'No Fix Planned'
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat: disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.

Sources

• CVE record CVE-2026-53266
• NVD CVE-2026-53266
• CISA KEV entry CVE-2026-53266
• Debian security tracker CVE-2026-53266
• Ubuntu CVE page CVE-2026-53266
• Red Hat CVE page CVE-2026-53266
• SUSE CVE page CVE-2026-53266
• Amazon Linux ALAS CVE page CVE-2026-53266
• Upstream fix (netfilter: bridge: make ebt_snat ARP rewrite writable)
• linux-cve-announce: CVE-2026-53266
• https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
• https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b
• https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0
• https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b
• https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093
• https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d
• https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.