ZeroDayAlert

CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability

Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Linux Kernel Added to KEV 2026-09-18 Federal due 2026-09-21 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This vulnerability affects the Linux Kernel, specifically the ebtables SNAT target component. The flaw permits an out-of-bounds write when processing ARP sender hardware address rewrites, and can be triggered via a splice-imported file page backing a socket buffer. The record notes that affected products may be end-of-life or end-of-service; you should treat this as a signal to prioritise systems running unsupported kernel versions.

How to check whether this touches you

  • Inventory which systems run Linux and identify their kernel versions using uname -r or equivalent package management queries.
  • Establish whether ebtables is loaded or in use on these systems; check with lsmod | grep ebtable or iptables-legacy -L where bridging and ARP filtering are configured.
  • Confirm network reachability to systems that satisfy the above: determine whether they accept inbound packets from untrusted networks, or whether they bridge networks where an attacker could send crafted ARP frames.
  • Check kernel version against the vendor's advisory to establish whether your running version is known to contain the flaw; note that some distributions backport fixes to older version strings, so absence of a patch tag does not guarantee vulnerability.

What to do

  1. Prioritise according to BOD 26-04: systems exposed to untrusted networks, particularly those bridging external and internal segments, take precedence.
  2. Obtain the vendor's patched kernel version and test it in a non-production environment first, paying attention to any changes in ebtables behaviour or dependencies.
  3. If immediate patching is not possible, reduce reachability by disabling ebtables rules that perform SNAT on ARP frames, or by isolating affected systems from networks where untrusted ARP traffic originates.
  4. Enable logging of kernel oops, page faults and memory corruption warnings; direct these to a central log store with sufficient retention to support later forensic review.
  5. If the system is end-of-life and no patch is available, escalate to your change control board for evaluation of discontinuation or transition to a supported kernel version.

If you find you were exposed

Exploitation of out-of-bounds writes in kernel memory typically crashes the system or corrupts kernel state; look backwards through your logs for unexpected reboots, kernel panics, or memory corruption messages correlating with inbound ARP traffic. Review packet captures or tcpdump logs for malformed or suspicious ARP frames arriving before any incidents. Retain all kernel logs and dmesg output; log retention is often the limiting factor in retrospective detection, so prioritise systems you suspect were exposed.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-53266 is being exploited. It cannot tell you whether Kernel is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →