CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable
A flaw in the Linux kernel's ebtables SNAT target allows writing to shared memory pages when rewriting ARP sender hardware addresses without ensuring writability, potentially causing file/memory corruption or denial of service.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebtsnat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite behind skbensurewritable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skbmacheader()/ethhdr(), while skb->data points at the Ethernet payload. Asking skbensurewritable() for ETHHLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different. It writes through skbstorebits() at an offset relative to skb->data:
skbstorebits(skb, sizeof(struct arphdr), info->mac, ETHALEN)
skbheaderpointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skbstorebits() maps the frag page and copies the new MAC address directly into it.
Ensure the ARP SHA range is writable before reading the ARP header and before calling skbstorebits().
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 63137bc5882a - Compensating control
After applying the fix, ensure the ebt_snat ARP sender hardware address rewrite is made writable before writing via skb_store_bits(), as addressed by netfilter: bridge: make ebt_snat ARP rewrite writable (commit 63137bc5882a).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53266?
The severity of CVE-2026-53266 is rated at risk level 37.
How do I fix CVE-2026-53266?
To fix CVE-2026-53266, update your Linux kernel to the latest version where this vulnerability is resolved.
What systems are affected by CVE-2026-53266?
CVE-2026-53266 affects systems running specific versions of the Linux kernel with netfilter and bridge functionality.
What type of vulnerability is CVE-2026-53266?
CVE-2026-53266 is a vulnerability related to the netfilter bridge ebt_snat functionality in the Linux kernel.
What does the fix for CVE-2026-53266 achieve?
The fix for CVE-2026-53266 ensures that the Ethernet source address rewrite is appropriately managed to enhance security.