CVE-2026-53266

Estado: AnalizadaAlta (8.8)⚠ Explotación activa

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: make ebt_snat ARP rewrite writable

The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a.

However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data:

Leer descripción completaMostrar menos

skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it.

Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

Detalles técnicos trazas, registros y código del informe original

        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.83%
Percentil entre todas las CVEs puntuadas: 56
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 18/9/2026
Plazo de remediación: 21/9/2026
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto secundarioT1499.004 Application or System Exploitationimpact65 %

Vulnerabilidad CWE-787 (buffer overflow) en netfilter del kernel Linux (AV:L/PR:L) permite escalada local. Explotación mediante ebtables SNAT; impactos: ejecución de código (escritura de datos en memoria) y DoS (crash por manipulación de fragmentos skb).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo
CWE-787

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-53266",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53266",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-18T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "76280b78cc9f23bdc6438e10ad6dff148ef8375b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "b7e91939ba9be805a62a257fa4e227dffbb88fa0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "afd64b59c3de9bbbdd3759e834fdc55cda716e0b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "153ea96c806aea395daba907a4f88480b6ad5093",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "b18675263db1147c8e1cab625400c13a0d87bd2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63137bc5882a1882c553d389fdeeeace86ee1741",
              "lessThan": "67ba971ae02514d85818fe0c32549ab4bfa3bf49",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f3839075a5f8dcf116c1abe35b36b018ac62445",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b7d23c2c87584eb429f115c078ed511be8b18e29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.73",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.8.17",
              "lessThan": "5.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.9.2",
              "lessThan": "5.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/bridge/netfilter/ebt_snat.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bridge/netfilter/ebt_snat.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-25T09:16:44.643",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable.  If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits()."
    }
  ],
  "lastModified": "2026-09-19T04:17:53.580",
  "cisaActionDue": "2026-09-21",
  "cisaExploitAdd": "2026-09-18",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "886AB560-B760-44F0-AD89-3F275E4C0F58",
              "versionEndExcluding": "5.5",
              "versionStartIncluding": "5.4.73"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEFC3ACE-365D-48E7-9C0A-019C74CC0725",
              "versionEndExcluding": "5.9",
              "versionStartIncluding": "5.8.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "992FFB71-217E-40A6-B8BD-5AA742898F28",
              "versionEndExcluding": "5.10.259",
              "versionStartIncluding": "5.9.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
              "versionEndExcluding": "5.15.210",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
              "versionEndExcluding": "6.12.94",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
              "versionEndExcluding": "6.18.36",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
              "versionEndExcluding": "7.0.13",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Linux Kernel Out-of-Bounds Write Vulnerability"
}