cyfenced.com →

[ CVE-2026-53266 · Published 25 Jun 2026 ]

Linux Kernel Out-of-Bounds Write Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS <1%9 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-18

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

CISA: Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0431

    Vulnerabilities fixed in IBM DataPower Gateway and underlying components Translated from Dutch

    Probability/damage M/HCVE-2023-53781CVE-2025-14087CVE-2025-14512+199 more CVEs
  • CERT-FRCERTFR-2026-AVI-1335

    Multiple vulnerabilities in the SUSE Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

    CVE-2026-72436CVE-2026-74632CVE-2026-89702+602 more CVEs
  • CERT-FRCERTFR-2026-AVI-1333

    Multiple vulnerabilities in the Ubuntu Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2026-72407CVE-2026-72436CVE-2026-68116+1919 more CVEs
  • CERT-FRCERTFR-2026-AVI-1286

    Multiple vulnerabilities in the Ubuntu Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

    CVE-2022-27664CVE-2022-3114CVE-2022-41723+2211 more CVEs
  • CERT-FRCERTFR-2026-AVI-1254

    Multiple vulnerabilities in the Red Hat Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-46325CVE-2026-53091CVE-2026-68480+61 more CVEs
  • CERT-FRCERTFR-2026-AVI-1252

    Multiple vulnerabilities in the Ubuntu Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2025-38724CVE-2025-54518CVE-2026-43490+1522 more CVEs
  • BSI CERT-BundWID-SEC-2026-3623

    IBM DataPower Gateway: Multiple vulnerabilities Translated from German

    CVE-2026-31411CVE-2025-39766CVE-2026-46331+199 more CVEs
  • CERT-FRCERTFR-2026-AVI-1230

    Multiple vulnerabilities in the Red Hat Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-31539CVE-2026-53002CVE-2026-64268+78 more CVEs
  • CERT-FRCERTFR-2026-AVI-1229

    Multiple vulnerabilities in the Ubuntu Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

    CVE-2024-27389CVE-2024-35865CVE-2024-36898+2108 more CVEs

[ References ]References