EXPOSURES › CVE-2026-53266
CVE-2026-53266
HIGH ⌖ ON CISA KEV · EXPLOITEDAn out-of-bounds write vulnerability in the Linux Kernel's ebtables SNAT target allows ARP hardware address rewrites to corrupt socket buffers, enabling remote code execution.
This kernel-level flaw permits attackers to execute arbitrary code by manipulating ARP data, directly violating CMMC/NIST 800-171 controls on system integrity and remote access. DIB organizations must patch immediately or migrate to supported kernel versions, as unpatched instances are actively exploited in the wild. Failure to address this exposes networks to ransomware and data breaches, impacting compliance posture and operational resilience.
Shame score — A fundamental kernel vulnerability was actively exploited in the wild, indicating severe negligence in patch management and system hardening.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.