CVE-2026-53266

A flaw was found in the Linux kernel's netfilter bridge ebtables SNAT (Source Network Address Translation) module. This vulnerability allows a local attacker on a system configured with specific bridge netfilter rules to improperly modify underlying memory pages during an ARP (Address Resolution Protocol) sender hardware address rewrite. This could lead to unintended system behavior, a denial of service, or potentially local privilege escalation, where an attacker gains higher access rights than intended.

An Important flaw in the Linux kernel's ebtables SNAT target allows a local attacker to achieve privilege escalation, memory corruption, or denial of service. This vulnerability requires specific bridge netfilter rules to be configured, limiting its impact to systems with such specialized network configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.