CVE-2026-53266 is a high-severity out-of-bounds write vulnerability in the Linux kernel's netfilter bridge subsystem, specifically the ebt_snat (ebtables Source Network Address Translation) target's optional ARP sender hardware address (SHA) rewrite feature.

The following Linux kernel versions are affected, on systems configured with ebtables SNAT rules using the ARP rewrite option on bridged interfaces:

• Linux kernel versions before 5.10.259
• Linux kernel versions before 5.15.210
• Linux kernel versions before 6.1.176
• Linux kernel versions before 6.6.143
• Linux kernel versions before 6.12.94
• Linux kernel versions before 6.18.36

Systems without ebtables SNAT ARP rewrite rules configured are not exposed to this specific attack path, though CERTVU still recommends patching.

Not affected / patched version:

• Linux kernel 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or later
• Distribution-specific patched kernel packages released by your Linux vendor

Successful exploitation may allow attackers to:

• Corrupt kernel memory or unrelated user-space mappings via crafted ARP packets traversing a bridge
• Cause a denial of service through kernel memory corruption or crashes
• Potentially achieve local privilege escalation on affected systems

CERTVU recommends the following:

1. Apply the vendor patch immediately

   Upgrade to a kernel release that ships the fix (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or later), or install your distribution's latest kernel security update, then reboot into the patched kernel.

2. Apply the interim workaround if patching is delayed

   Disable ARP sender hardware address rewriting in ebtables SNAT rules (remove the --snat-arp option), or remove ebtables SNAT rules operating on ARP traffic on bridge interfaces. Where ebtables SNAT is not required at all, consider blacklisting the ebt_snat module.

3. Treat this as high priority