Linux kernel ebtables SNAT exploited, root (CVE-2026-53266)

Actively exploited in the wild - CVE-2026-53266 is a high-severity local privilege escalation in the Linux kernel netfilter bridge ebtables SNAT target that grants a low-privileged attacker unauthorized writes into page cache and escalates to root. Kernel fixes are merged upstream; update your distribution kernel package immediately.

Overview

The ebtables SNAT target rewrites the Ethernet source address on packets crossing a Linux bridge. Alongside the MAC rewrite it can optionally rewrite the ARP sender hardware address. That ARP write goes through skb_store_bits() at an offset relative to skb->data, but the code never verified that the destination range in the socket buffer was actually writable.

Reading the ARP header safely via skb_header_pointer() is not the same as making the sender hardware address range writable. When that range still sits in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the fragment page and copies the attacker-supplied MAC address straight into it. The result is a write into memory the caller was never supposed to touch.

Impact

An attacker with a local account and the ability to route traffic through a bridge with an ebtables SNAT rule can corrupt page-cache contents tied to files previously spliced into a socket. Because the written bytes are attacker-influenced but partly constrained, this is best treated as a memory-corruption primitive: expect privilege escalation to root, container escape on hosts sharing the page cache, and integrity loss for cached file data.

The CVSS vector is AV:L/AC:L/PR:L/UI:N for a base score of 8.8. Local access is required, but no user interaction and no elevated privileges beyond a normal login. CISA has added this to the Known Exploited Vulnerabilities catalog, so exploitation against unpatched systems should be assumed to be happening now. The EPSS score remains low at 0.1%, which reflects that this is a targeted local attack rather than a wormable remote one.

Remediation

Update to the kernel build your distribution shipped with the fix for CVE-2026-53266. The upstream patch makes the ARP sender hardware address range writable before the header is read and before skb_store_bits() is called. Reboot after upgrading; live kernel patching will not reliably cover netfilter bridge paths already loaded.

If you cannot patch immediately:

• Remove or disable ebtables SNAT rules that perform ARP sender hardware address rewrites on bridges exposed to untrusted local workloads.
• Restrict local shell access and container workload placement on bridge hosts until kernels are updated.
• Monitor for unusual page-cache writes or crashes in bridge SNAT paths as a compromise signal.

Security Insight

Netfilter bridge code has repeatedly produced local privilege escalation because it mixes safe header reads with unsafe payload writes - the same class of mistake that produced earlier bridge and packet-socket issues. What stands out here is how little the exploit needs: one splice-imported page and a MAC-length write. That minimalism is a reminder that page-cache write primitives are now the preferred bridge from a normal local account to root. For defenders, the priority is not the EPSS number but the KEV listing: track CVE-2026-53266 against your kernel inventory, alongside recent additions like the Linux root bug CVE-2026-31431 and the CrackArmor AppArmor escalation flaws, and treat kernel patch latency on bridge hosts as measurable exposure.

Further Reading

• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• Nine CrackArmor Flaws in Linux AppArmor Enable Root
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs