Linux Kernel Out-of-Bounds Write Vulnerability
OOB write in Linux kernel ebtables SNAT target. ARP address rewrite lands in a nonlinear socket buffer. CVSS 8.8, public exploits confirmed. CISA KEV Sept. 18.
- Vendor
- Linux
- Product
- Kernel
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-53266 being exploited?
Yes. CISA added CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-53266 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Out-of-bounds write in the ebtables SNAT target in the Linux kernel. When processing ARP packets, a hardware address rewrite in the SNAT target can write an ARP sender hardware address directly into a nonlinear socket-buffer fragment backed by a splice-imported file page, outside the bounds of the original allocation.
Red Hat rated this “high risk” and confirmed public exploits are already in circulation. Documented outcomes include denial of service, unintended system behavior, and local privilege escalation. Particularly relevant on systems running ebtables for network bridging or container networking.
CISA added this to the Known Exploited Vulnerabilities catalog on September 18, 2026. Federal agencies have until September 21, 2026 to apply mitigations under BOD 26-04. See the NVD record and your distribution vendor’s advisories for patch details.
Full coverage: CISA Adds Three Exploited Linux Kernel Flaws to KEV.
Other Linux Kernel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 16.1% | |
| CVE-2026-98432 Linux Kernel IPv4 TCP Use-After-Freewrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2025-39964 Linux Kernel Race Condition Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 1.6% | |
| CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 3.3% | |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability | [ HIGH ] | 7.8 | 0.7% | |
| CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability | [ HIGH ] | 7.8 | 8.9% | |
| CVE-2026-53264 Linux kernel traffic-control subsystem use-after-free racewrite-up | [ HIGH ] | 7.8 | 0.5% | — |
| CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability | [ HIGH ] | 7.8 | 5.5% |
