CISA KEV Flags Linux Kernel ebtables SNAT Out-of-Bounds Write

Key points

• CISA KEV includes a Linux kernel out-of-bounds write in the ebtables SNAT target.
• The bug involves an ARP sender hardware address rewrite into a nonlinear socket-buffer fragment.
• Affected products may be end-of-life or end-of-service; transition to supported versions.
• Apply vendor mitigations and follow BOD 26-04 and CISA forensics triage guidance.
• Assess internet exposure of Linux-based systems and network appliances.

CISA's Known Exploited Vulnerabilities catalog now includes a Linux kernel out-of-bounds write in the ebtables SNAT target. The flaw allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. That is a kernel memory-corruption condition in the networking path, and the associated NVD entry is CVE-2026-53266.

Organizations running Linux systems that use ebtables, especially bridge or netfilter configurations, may be affected. In K-12 environments, this can include Linux servers, virtualization hosts, firewalls, routers, and network appliances. The advisory notes that impacted products could be end-of-life or end-of-service, which raises risk because unsupported versions may never receive a fix.

An out-of-bounds write in the kernel can lead to crashes, data corruption, or privilege escalation depending on how the corrupted memory is used. Because CISA lists this as known exploited, the practical urgency is higher than the medium classification alone suggests. BOD 26-04 requires risk-based prioritization of security updates, and CISA also points to forensics triage requirements.

CISA advises discontinuing use of affected products or transitioning to a supported version when mitigations are unavailable. Required actions include applying vendor mitigations, following BOD 26-04 for cloud services, and evaluating each asset's internet exposure. Districts should verify affected kernel versions and ebtables usage before assuming they are unaffected.

What to watch: vendor kernel updates, ebtables module usage, unusual ARP activity, and kernel crash reports. Confirm details for CVE-2026-53266 in NVD and vendor advisories, and track KEV remediation deadlines. If a supported patch is not available, disabling the ebtables SNAT target or restricting administrative access may reduce exposure, but those steps should be validated against operational needs.

What to do now

1. Inventory Linux kernel versions and confirm whether ebtables SNAT is used on servers, appliances, VMs, and network devices.
2. Apply vendor kernel updates or documented mitigations immediately, prioritizing internet-facing and end-of-life systems.
3. If no patch exists, disable the ebtables SNAT target or restrict CAP_NET_ADMIN and administrative access where operationally feasible.
4. Follow BOD 26-04 risk-based patching guidance and CISA forensics triage requirements for any suspected exploitation.
5. Review internet exposure of Linux-based assets and segment management interfaces from untrusted networks.
6. Verify CVE-2026-53266 in NVD and vendor advisories to confirm affected versions and fixed releases.
7. Track KEV remediation deadlines and document any exceptions or compensating controls.

Original source

CISA Known Exploited Vulnerabilities