Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-53266 2026-09-18

CVE-2026-53266: Linux Kernel ebtables SNAT Out-of-Bounds Write Added to CISA KEV

"CISA added CVE-2026-53266, an out-of-bounds write in the Linux kernel's ebtables SNAT target, to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a three-day remediation deadline of 2026-09-21."

CISA added CVE-2026-53266, an out-of-bounds write in the Linux kernel's ebtables SNAT target, to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a three-day remediation deadline of 2026-09-21.

What Is It

The ebtables SNAT target (net/bridge/netfilter/ebt_snat.c) keeps its Ethernet source address rewrite behind skb_ensure_writable(skb, 0). That guard is deliberate: at the bridge ebtables hooks the Ethernet header is reached through skb_mac_header()/eth_hdr() while skb->data points at the payload, so requesting ETH_HLEN bytes would check the wrong region and reintroduce an earlier small-packet regression.

The optional ARP sender hardware address (SHA) rewrite behaves differently. It writes via skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) at an offset relative to skb->data. skb_header_pointer() only safely reads the ARP header; it does not make the later SHA range writable. If that range still sits in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. The fix ensures the ARP SHA range is writable before the header read and before the skb_store_bits() call.

CWE-787 (Out-of-bounds Write). CVSS 3.1 base score 8.8 (HIGH), vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Why It Matters

CISA's SSVC assessment marks exploitation as active, with technical impact rated total and automatable no. KEV inclusion indicates this is being exploited in the wild. Known ransomware campaign use is listed as Unknown. The scope-changed CVSS vector and the write landing in a splice-imported file page suggest corruption could reach memory outside the network stack's own buffers, though the practical reach in any given deployment will depend on how the affected skb was constructed. CISA also flags this entry as requiring forensic triage.

What's Vulnerable

Linux kernel, file net/bridge/netfilter/ebt_snat.c. Affected from 5.10 onward, plus stable backport ranges 5.4.73–5.5, 5.8.17–5.9, and 5.9.2–5.10. Fixed versions: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and 7.1. Kernels before 5.10 that fall outside the listed stable ranges are not listed as affected. CISA notes impacted products could be end-of-life or end-of-service, in which case users should discontinue use or move to a supported version.

Patch Status

Patched upstream across eight stable branches. Required action per CISA: apply mitigations per vendor instructions in compliance with BOD 26-04 and CISA's Forensics Triage Requirements; follow applicable BOD 26-04 guidance for cloud services, or discontinue use if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure. Due date: 2026-09-21.

Sources