CVE-2026-53266 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-06-25

Added to CISA KEV: 2026-09-18 85 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
PATCH PRIORITY: HIGH for multi-tenant environments (cloud VMs, container hosts, shared hosting) where untrusted local code execution is possible — apply kernel updates to fixed versions (5.10.259+, 5.15.210+, 6.1.176+, 6.6.143+, 6.12.94+, 6.18.36+, 7.0.13+, 7.1+)
PATCH PRIORITY: MEDIUM for single-tenant servers and standard deployments — patch as part of routine kernel update cycle
MITIGATION (if immediate patching not possible): Audit and restrict ebtables SNAT rule configurations on bridge interfaces; remove unnecessary SNAT rules to eliminate the vulnerable code path
MITIGATION: Restrict user namespace creation via 'sysctl -w kernel.unprivileged_userns_clone=0' (on supported distributions) to prevent unprivileged CAP_NET_ADMIN acquisition
MONITORING: Enable kernel audit logging (auditd) for CAP_NET_ADMIN usage and ebtables rule modifications; alert on unexpected bridge/netfilter rule changes by non-root users
MONITORING: Monitor for unusual splice/sendfile system call patterns combined with ARP traffic on bridge interfaces as a potential indicator of exploitation attempts
CONTEXT: This vulnerability is NOT directly internet-exploitable; prioritize patching systems where untrusted local users or containers can execute code (Kubernetes nodes, VPS platforms, CI/CD runners)

🔍 Web Intelligence (Kagi · 2026-09-18)

Summary

CVE-2026-53266 is a privilege escalation vulnerability in the Linux kernel's `netfilter` bridge component specifically related to how `ebtables` handles ARP (Address Resolution Protocol) rewrite operations. The vulnerability stems from the `ebt_snat` target incorrectly writing to shared memory pages during ARP hardware address modification, which can lead to memory corruption. This issue is significant because it allows a local attacker to manipulate system memory to elevate privileges, cause a denial of service, or corrupt data, though it is limited to systems configured with specific bridge netfilter rules.

Exploitation

Active Exploitation: There are currently no reports of active, widespread exploitation in the wild.
Threat Actors/Campaigns: No specific threat actors or ransomware campaigns have been publicly linked to this vulnerability.
Proof-of-Concept/Exploit Tools: No public proof-of-concept exploits or automated attack tools are widely available at this time.
Attack Prerequisites:

- Local Access: Exploitation requires the attacker to already have local access to the system. - Authentication: The attacker must be authenticated on the local system. - Configuration Dependency: The system must be configured with specific bridge netfilter rules (specifically involving `ebtables` SNAT targets), which limits the attack surface. - User Interaction: No user interaction is required once local access is established.

Affected Products & Patches

Affected Versions: Vulnerable versions include various releases of the Linux kernel that incorporate the flawed `netfilter` bridge ARP rewrite logic.
Patch Availability: Patches have been released by major Linux distributions. For example, Red Hat issued security advisory RHSA-2026:39083 on August 4, 2026, to address this kernel vulnerability.
Mitigations:

- Apply vendor-provided kernel updates as soon as possible. - If immediate patching is not possible, review and restrict the usage of `ebtables` SNAT rules in bridge configurations to minimize the attack surface.

Impact

Successful Exploitation: Successful exploitation provides a local attacker with the ability to achieve privilege escalation (gaining root-level or elevated access), perform arbitrary memory corruption, or trigger a denial of service by crashing the kernel.
Business Risk: For internet-facing systems, the primary risk is that if an attacker manages to gain a low-privileged foothold (e.g., through a separate web application vulnerability), they can use this kernel flaw to escalate their privileges to full system control. This poses a critical risk to data confidentiality, integrity, and system availability.