Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2026-06-25

CVE-2026-53266

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

  1. KEV
  2. 2 days →First PoC

Signals

Exploited in the wild
Yesadded 2026-09-18 · due 2026-09-21. An observation, not a forecast.
EPSS · 30-day forecast
1%Chance of exploitation in the next 30 days, 57th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

GitHub PoCs · by trust, then stars1

  1. suominen/CVE-2026-53266 ↗Trust ok 100

    Tracking CVE-2026-53266, the Linux kernel ebtables SNAT ARP-rewrite page-cache write

    ★ 0 · created 2026-09-20

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

1 dispatch
  1. CISA adds CVE-2026-53266 (Linux Kernel) to the Known Exploited Vulnerabilities catalogKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.