~/news/2026-09-18-linux-ebtables-snat-out-of-bounds-write.md
What happened. CISA added CVE-2026-53266, an out-of-bounds write in the Linux kernel's bridge netfilter code, to the Known Exploited Vulnerabilities catalog on 2026-09-18. The flaw sits in the ebtables SNAT target, which rewrites a frame's source MAC. It is fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13.
Why it matters. NVD scores it 8.8, local, low privileges, scope changed, and the shape is the point. The rule that reaches this code is installed by anything holding CAP_NET_ADMIN over a bridge, which a container or an unprivileged user namespace can grant, so this is not only a root bug. The write lands in a page the kernel never granted writable, and that page can belong to a file, not to the packet. Corruption that escapes the network stack is not what anyone expects from a NAT target.
Mechanism. ebt_snat_tg() calls skb_ensure_writable(skb, 0) before overwriting the Ethernet source address, which is right, because at the bridge hooks skb->data points at the payload while the header is reached through skb_mac_header(). The ARP rewrite underneath is not covered by it. It calls skb_store_bits() at an offset of sizeof(struct arphdr), 8 bytes in from skb->data, and skb_header_pointer() only guarantees a safe read of the ARP header, never write access to the sender hardware address that follows. If that address still lives in a nonlinear fragment backed by a splice-imported file page, skb_store_bits() maps the fragment page and copies the configured MAC straight into it. The fix adds skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN) before both the read and the store.
What to do. Apply the kernel update carrying the backport, and drop bridge source NAT rules nothing needs, which removes the reachable path rather than the bug. Patching does not repair a page already written, and KEV flags this entry for forensic triage, so the open question on an affected host is what was overwritten before the update, not whether the update arrived in time.