CVE-2026-53266
published 2026-06-25CVE-2026-53266: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the…
PriorityP181high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-09-21
Exploited in the wild
EPSS
0.83%
57.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:
skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)
skb_header_pointer() only safely reads the ARP header; it does not make
the later sender hardware address range writable. If that range is
still held in a nonlinear skb fragment backed by a splice-imported file
page, skb_store_bits() maps the frag page and copies the new MAC address
directly into it.
Ensure the ARP SHA range is writable before reading the ARP header and
before calling skb_store_bits().
Affected
76 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 5.4.73 < 5.5 | 5.5 |
| linux | linux | >= 5.8.17 < 5.9 | 5.9 |
| linux | linux | >= 5.9.2 < 5.10 | 5.10 |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 | bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < 76280b78cc9f23bdc6438e10ad6dff148ef8375b | 76280b78cc9f23bdc6438e10ad6dff148ef8375b |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < b7e91939ba9be805a62a257fa4e227dffbb88fa0 | b7e91939ba9be805a62a257fa4e227dffbb88fa0 |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < afd64b59c3de9bbbdd3759e834fdc55cda716e0b | afd64b59c3de9bbbdd3759e834fdc55cda716e0b |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < 153ea96c806aea395daba907a4f88480b6ad5093 | 153ea96c806aea395daba907a4f88480b6ad5093 |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < b18675263db1147c8e1cab625400c13a0d87bd2d | b18675263db1147c8e1cab625400c13a0d87bd2d |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 | c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 |
| linux | linux | >= 63137bc5882a1882c553d389fdeeeace86ee1741 < 67ba971ae02514d85818fe0c32549ab4bfa3bf49 | 67ba971ae02514d85818fe0c32549ab4bfa3bf49 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 5.4.73 < 5.5 | 5.5 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_ubuntu9.1CRITICAL
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-10-09·CVSS 5.5
CVE-2026-46086 [MEDIUM] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptogr
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-10-08·CVSS 9.1
CVE-2026-64087 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- ARM32 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Intel NPU Driver;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-08
CVE-2026-63949 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- x86 architecture;
- Intel NPU Driver;
- Auxiliary display drivers;
- Compressed RAM block device driver;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Input Device (Mouse) drivers;
- Multiple devices driver;
- Media drivers;
- Fastrpc Driver;
- Ethernet bonding driver;
- Network drivers;
- Mellanox network drivers;
- Microsoft Azure Network Adapter (MANA) d
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-10-08
CVE-2026-63971 Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- x86 architecture;
- Intel NPU Driver;
- Auxiliary display drivers;
- Compressed RAM block device driver;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Input Device (Mouse) drivers;
- Multiple devices driver;
- Media drivers;
- Fastrpc Driver;
- Ethernet bonding driver;
- Network drivers;
- Mellanox network drivers;
- Microsoft Azure Network Adapter (M
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-10-08
CVE-2026-63949 Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- x86 architecture;
- Intel NPU Driver;
- Auxiliary display drivers;
- Compressed RAM block device driver;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Input Device (Mouse) drivers;
- Multiple devices driver;
- Media drivers;
- Fastrpc Driver;
- Ethernet bonding driver;
- Network drivers;
- Mellanox network drivers;
- Microsoft Azure Network Adapter
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-68461 [MEDIUM] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI driv
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptograph
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security is
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-68461 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-09-29·CVSS 9.1
CVE-2026-64191 [CRITICAL] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were d
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were di
Ubuntu
Linux kernel (NVIDIA BaseOS) vulnerabilities
vendor_ubuntu·2026-09-22
CVE-2026-64504 Linux kernel (NVIDIA BaseOS) vulnerabilities
Title: Linux kernel (NVIDIA BaseOS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-53358 [CRITICAL] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- PowerPC architecture;
- RIS
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390
CISA
Linux Kernel Out-of-Bounds Write Vulnerability
cisa·2026-09-18·CVSS 8.8
CVE-2026-53266 [HIGH] CWE-787 Linux Kernel Out-of-Bounds Write Vulnerability
Vulnerability: Linux Kernel Out-of-Bounds Write Vulnerability
Affected: Linux Kernel
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discont
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-09-15
CVE-2026-63869 Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buf
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were disc
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Red Hat
kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
vendor_redhat·2026-06-25·CVSS 8.8
CVE-2026-53266 [HIGH] kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:
skb_store_bits(skb, size
GHSA
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind sk
ghsa_unreviewed·2026-06-25
CVE-2026-53266 In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind sk
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:
skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)
skb_header_pointer
VulnCheck
Linux Kernel Out-of-Bounds Write Vulnerability
vulncheck·2026·CVSS 8.8
CVE-2026-53266 [HIGH] CWE-787 Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Affected: Linux Kernel
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of th
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53266 kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
bugzilla·2026-06-25·CVSS 8.8
CVE-2026-53266 [HIGH] CVE-2026-53266 kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
CVE-2026-53266 kernel: netfilter: bridge: make ebt_snat ARP rewrite writable
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:
skb_s
Bugzilla
CVE-2026-53266 kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
bugzilla·2026-06-05·CVSS 8.8
CVE-2026-53266 [HIGH] CVE-2026-53266 kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
CVE-2026-53266 kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
A flaw in the Linux kernel's ebtables SNAT target allows writing to shared memory pages when rewriting ARP sender hardware addresses without ensuring writability, potentially causing file/memory corruption or denial of service.
Discussion:
A memory corruption flaw was found in the Linux kernel's netfilter subsystem
in the ebtables SNAT (Source Network Address Translation) target. When
rewriting the ARP sender hardware address (SHA), the code fails to ensure
the target memory region is writable before modification. The vulnerable
code path uses skb_header_pointer() to read the ARP header, which only
provides safe read access, followed by skb_store_bits()
Qualys
CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
blogs_qualys·2026-09-23·CVSS 9.8
CVE-2025-39682 [CRITICAL] CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
## Table of Contents
The Three Linux Kernel CVEs in KEV
CISA BOD 26-04 Remediation Timeline
Why This Matters
Our Recommendation: Deploy the Kernel Updates with Qualys TruRisk Eliminate
## Executive Summary
CISA added three actively exploited Linux kernel vulnerabilities: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog on September 18, 2026, triggering a 3-day remediation deadline that passed on September 21. Under CISA BOD 26-04, a 3-day window applies to CVE-2025-39682 across all assets, and for the other two, the deadline is 3 days for publicly exposed assets and 14 days for internal assets. With the September 21 deadline now passed, affected systems should be patched immediately. Qualys TruRisk Eliminate identifies affected assets with vulnerability context a
Hackernews
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
blogs_hackernews·2026-09-19·CVSS 7.1
CVE-2025-39682 [HIGH] CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path that could allow local authenticated users to trigger memory disclosure or denial-of-service (DoS).
CVE-2026-53266 (CVSS score: 8.8) - An out-of-bounds write vulnerabili
https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375bhttps://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0bhttps://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2dhttps://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266
2026-06-25
Published
2026-09-18
Added to CISA KEV
Exploited in the wild