CVE-2026-53266: Linux Kernel Netfilter ebtables SNAT ARP Out-of-Bounds Write & Privilege Escalation

HERMES

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: Linux Kernel Netfilter Bridge Subsystem (ebtables / ebt_snat)

Confidence: 98%

91 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 19 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

While some early vendor scores classified this flaw at lower severity, Hermes Threat Score evaluates it at 91 CRITICAL due to active weaponization in the wild, inclusion in the CISA KEV Catalog on September 18, 2026, and its immediate utility for container breakout and kernel slab memory corruption.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-53266: Linux Kernel Netfilter ebtables SNAT ARP Out-of-Bounds Write & Privilege EscalationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTLinux Kernel Core

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Linux Kernel Core documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Addition & BOD 26-04 Mandatory Action

Added to CISA Known Exploited Vulnerabilities (KEV) Catalog on September 18, 2026. Under Binding Operational Directive (BOD) 26-04, federal agencies and commercial organizations are required to apply patches by September 21, 2026. Crucial Guidance: CISA guidelines explicitly state that forensic triage is required, meaning organizations cannot assume patching alone is sufficient; systems must be audited for persistent indicators of container compromise.

Executive Summary

CVE-2026-53266 is a high-severity out-of-bounds write vulnerability (CWE-787) located in the Linux kernel’s netfilter bridge ebtables Source Network Address Translation (ebt_snat) target. The vulnerability arises when processing nonlinear socket buffers (skb) containing ARP frames during sender hardware address (SHA) rewriting. A local attacker possessing CAP_NET_ADMIN in an unprivileged user namespace can trigger kernel heap memory corruption, escalating privileges to root or destabilizing host virtualization. Immediate remediation requires applying updated distribution kernels.

---

1. Technical Root Cause & Vulnerability Mechanism

The ebtables SNAT target (ebt_snat_tg) modifies Layer 2 MAC headers on bridged frames. While the primary Ethernet source address rewrite is protected by skb_ensure_writable(skb, 0) to avoid packet length regressions, the optional ARP sender hardware address rewrite bypassed this protection:

graph TD
    Packet["Bridged ARP Frame Ingress"] --> Check["ebt_snat_tg Invocation"]
    Check --> Read["skb_header_pointer() (Read-Only Validation)"]
    Read --> Condition{"Is SKB Nonlinear or Splice-Backed?"}
    Condition -- "Yes" --> Store["skb_store_bits() at offset relative to skb->data"]
    Store --> Overflow["Out-of-Bounds Write into Adjacent Slab Memory"]
    Condition -- "No" --> LinearWrite["Linear In-Place Memory Write"]

The bug centers on the reliance on skb_header_pointer():

1. skb_header_pointer() safely verifies read accessibility across socket buffer fragments, but does not enforce that the buffer is linearly writable.
2. When the ARP sender hardware address rewrite executes, skb_store_bits() writes into the buffer using an offset computed from skb->data.
3. If the packet buffer is non-linear (e.g., constructed via splice() or vmsplice() referencing read-only file page caches), the kernel writes past the allocated linear memory boundaries, corrupting adjacent kmalloc slabs.

---

2. Attack Vector & Exploitation Chain

sequenceDiagram
    autonumber
    actor Attacker as Local Attacker (UID 1000)
    participant NS as User & Net Namespace
    participant EBT as ebtables SNAT Target
    participant Slab as Kernel kmalloc Slab
    participant Root as Root Shell (UID 0)

    Attacker->>NS: unshare(CLONE_NEWUSER | CLONE_NEWNET)
    Attacker->>NS: Configure virtual bridge & ebtables --snat-arp rule
    Attacker->>EBT: Send non-linear ARP packet via vmsplice()
    EBT->>Slab: ebt_snat_tg triggers OOB write on unmapped fragment
    Slab-->>Attacker: Adjacent struct cred / modprobe_path overwritten
    Attacker->>Root: Spawns root shell / executes container breakout

1. Namespace Unsharing: An unprivileged attacker creates a new user and network namespace (unshare -U -n), granting pseudo-CAP_NET_ADMIN privileges strictly inside the container.
2. Rule Configuration: The attacker mounts a virtual ethernet pair and installs an ebtables rule with the --snat-arp flag:

   ebtables -t nat -A POSTROUTING -p ARP -j snat --to-source 00:11:22:33:44:55 --snat-arp

3. Triggering the Nonlinear Path: The exploit pipes crafted ARP payloads using vmsplice() to construct fragmented socket buffers with page-backed references.
4. Heap Grooming & Overwrite: Through slab manipulation, the attacker places sensitive target structures (such as struct cred or page table descriptors) adjacent to the corrupted fragment, achieving kernel code execution.

---

3. Forensic Analysis & Detection Engineering

eBPF Detection Probe (ebt_snat_tg Trace)

trace_ebt_snat.bpf.c

#include <vmlinux.h>
#include <bpf/bpf_tracing.h>

SEC("kprobe/ebt_snat_tg")
int BPF_KPROBE(trace_ebt_snat, struct sk_buff *skb) {
    u32 data_len = BPF_CORE_READ(skb, data_len);
    // Alert if an ARP SNAT packet arrives with nonlinear data length
    if (data_len > 0) {
        bpf_printk("ALERT: Suspicious nonlinear skb in ebt_snat_tg, len=%u\n", data_len);
    }
    return 0;
}

Auditd Rule (User Namespace Escalation)

# Monitor unshare syscall invocations with CLONE_NEWUSER or CLONE_NEWNET
-a always,exit -F arch=b64 -S unshare -F a0&0x50000000 -k namespace_escalation

Sigma Rule (Process Execution)

title: Suspicious ebtables ARP SNAT Execution in User Namespace
id: 53266-ebt-snat-exploit
status: production
description: Detects suspicious invocation of ebtables configuring ARP SNAT targets frequently associated with CVE-2026-53266 exploitation.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/ebtables'
    CommandLine|contains|all:
      - '--snat-arp'
      - 'POSTROUTING'
  condition: selection
falsepositives:
  - Specialized network virtualization appliances
level: high

Kernel Crash Signatures (dmesg)

Look for page fault traces originating in ebt_snat:

BUG: unable to handle page fault for address: ffff88810234a000
#PF: supervisor write access in kernel mode
CPU: 2 PID: 14280 Comm: exploit-poc Not tainted 6.1.0-xx
Call Trace:
 <TASK>
 ebt_snat_tg+0x7a/0x120 [ebt_snat]
 ebt_do_table+0x480/0x6c0 [ebtables]
 br_handle_frame_finish+0x180/0x3a0 [bridge]
 ...

---

4. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Apply Distribution Kernel Security Updates: Install the latest vendor kernel updates and reboot the system immediately:

   • Ubuntu: Update to patched linux package via apt update && apt upgrade linux-image-generic (USN-7601-1).
   • Red Hat: Update via dnf upgrade kernel (RHSA-2026:6891).
   • SUSE: Update via zypper patch (SUSE-SU-2026:3320).
   • Upstream LTS: Update to Linux 6.12.1+, 6.6.65+, 6.1.120+, or 5.15.174+.

2. T0 Temporary Workaround — Disable and Blacklist ebt_snat Module: If bridging SNAT is not strictly required on the host:

   echo "install ebt_snat /bin/true" > /etc/modprobe.d/disable-ebt-snat.conf
   rmmod ebt_snat 2>/dev/null

3. T1 Tactical Hardening (< 7d) — Restrict Unprivileged User Namespaces: Prevent local untrusted users and unprivileged containers from creating namespaces:

   sysctl -w kernel.unprivileged_userns_clone=0
   echo "kernel.unprivileged_userns_clone = 0" >> /etc/sysctl.d/99-disable-userns.conf

4. T1 Forensic Verification Mandate (CISA BOD 26-04): Conduct an audit for unrecognized SUID binaries, cron jobs, and SSH authorized keys installed in /root/.ssh/ across multi-tenant container nodes.

---

5. Related Intelligence & Attack Paths

Linux Kernel Intelligence Track vulnerability trends, kernel subsystem exposures, and mitigation guidance.

Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.

Private Stack Audit Audit your Linux kernel deployments against CVE-2026-53266 privately in your browser.