CISA alerts of active exploitation of three Linux kernel flaws
CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.
88
CVE-2026-53266
Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge)
CISA: Linux Kernel Out-of-Bounds Write Vulnerability
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p61
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target: when the optional ARP sender-hardware-address rewrite is active, the kernel writes the new MAC address via skb_store_bits() without first making that byte range writable. If the ARP sender hardware address bytes sit in a nonlinear skb fragment backed by a splice-imported file page, the write maps the fragment page and copies the MAC directly into a file-backed page-cache page, corrupting kernel-managed memory. A local, low-privileged attacker (for example a container tenant, VM, or user able to send traffic into a bridge using ebtables SNAT with ARP rewriting) can trigger this with crafted ARP packets, gaining kernel memory corruption usable for privilege escalation or integrity/availability impact (CVSS 3.1 8.8, scope changed). Any Linux system running a kernel with the vulnerable ebtables SNAT code in a bridged-networking configuration that performs this ARP rewrite is affected; the source data does not state specific affected version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation, although EPSS is low (0.1%, 2nd percentile) and no public proof-of-concept is known.
What to do: Update the kernel via your vendor's stable/security channel to a build that includes the upstream fix 'netfilter: bridge: make ebt_snat ARP rewrite writable', prioritizing internet-exposed and multi-tenant hosts in line with CISA BOD 26-04. Audit bridges, routers, gateways and virtualization hosts for ebtables SNAT rules that rewrite ARP sender hardware addresses and remove or disable those rules as an interim mitigation where patching is not yet possible. Restrict untrusted local/guest access to systems using ebtables bridging until patched.
| Product | Affected |
|---|---|
| Linux kernel | — |
Estimated exposure
mass≈ billions of devices ship the affected kernel code across distributions, servers, cloud, Android and embedded; realistically exploitable hosts (bridges with… — The Linux kernel is deployed on well over a billion systems, and the vulnerable netfilter bridge/ebtables code ships broadly, but reaching the flaw requires the narrower ebtables SNAT configuration with ARP MAC rewriting common on…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
KEVCISA Known Exploited Vulnerability
- Affected
- Linux Kernel
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
7 storiesSeptember 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV with a September 21 federal patching deadline.
80
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV; federal patch deadline September 21, 2026.
80
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) to its KEV catalog, federal patch deadline September 21, 2026.
78
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
CISA added three exploited Linux kernel flaws to its KEV catalog, ordering federal agencies to patch within three days.
75
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited Linux kernel flaws, CVE-2025-39964 (race condition) and CVE-2026-53266 (out-of-bounds write), to its KEV Catalog.
72