Linux kernel netfilter bridge ebt_snat ARP sender hardware address out-of-bounds write via splice-backed skb

#!/usr/bin/env bash
# CVE-2026-53266 Checker — netfilter bridge ebt_snat ARP rewrite OOB write
# Checks running kernel version against fixed versions and module status.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[0;33m'; NC='\033[0m'

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch from kernel version string
# Handles formats like: 6.1.176-1~deb11u1, 5.14.0-687.24.1.el9_5, 6.12.94-1-default
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION" ]]; then
    echo -e "${YELLOW}UNKNOWN${NC} — Could not parse kernel version from: $KERNEL"
    exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# Version comparison function
ver_gte() {
    # Returns 0 if $MAJOR.$MINOR.$PATCH >= $1.$2.$3
    local cmp_maj=$1 cmp_min=$2 cmp_pat=$3
    if (( MAJOR > cmp_maj )); then return 0; fi
    if (( MAJOR == cmp_maj && MINOR > cmp_min )); then return 0; fi
    if (( MAJOR == cmp_maj && MINOR == cmp_min && PATCH >= cmp_pat )); then return 0; fi
    return 1
}

PATCHED=false

# Check against fixed versions per stable branch
if (( MAJOR >= 8 )); then
    PATCHED=true
elif (( MAJOR == 7 )); then
    if (( MINOR >= 1 )); then
        PATCHED=true
    elif (( MINOR == 0 && PATCH >= 13 )); then
        PATCHED=true
    fi
elif (( MAJOR == 6 )); then
    if (( MINOR == 18 )) && ver_gte 6 18 36; then PATCHED=true;
    elif (( MINOR == 12 )) && ver_gte 6 12 94; then PATCHED=true;
    elif (( MINOR == 6 )) && ver_gte 6 6 143; then PATCHED=true;
    elif (( MINOR == 1 )) && ver_gte 6 1 176; then PATCHED=true;
    elif (( MINOR > 18 )); then PATCHED=true;
    fi
elif (( MAJOR == 5 )); then
    if (( MINOR == 15 )) && ver_gte 5 15 210; then PATCHED=true;
    elif (( MINOR == 10 )) && ver_gte 5 10 259; then PATCHED=true;
    fi
fi

# Check ebt_snat module status
MOD_STATUS="unknown"
if lsmod 2>/dev/null | grep -q ebt_snat; then
    MOD_STATUS="loaded"
elif modprobe --dry-run ebt_snat 2>/dev/null; then
    MOD_STATUS="available (not loaded)"
else
    MOD_STATUS="not available (blacklisted or absent)"
fi
echo "[*] ebt_snat module: $MOD_STATUS"

# Check unprivileged user namespace status
USERNS="unknown"
if [[ -f /proc/sys/kernel/unprivileged_userns_clone ]]; then
    USERNS_VAL=$(cat /proc/sys/kernel/unprivileged_userns_clone)
    if [[ "$USERNS_VAL" == "0" ]]; then USERNS="disabled"; else USERNS="enabled"; fi
elif [[ -f /proc/sys/user/max_user_namespaces ]]; then
    USERNS_VAL=$(cat /proc/sys/user/max_user_namespaces)
    if [[ "$USERNS_VAL" == "0" ]]; then USERNS="disabled"; else USERNS="enabled ($USERNS_VAL max)"; fi
fi
echo "[*] Unprivileged user namespaces: $USERNS"

if $PATCHED; then
    echo -e "\n${GREEN}PATCHED${NC} — Kernel $KERNEL contains the fix for CVE-2026-53266."
    exit 0
else
    echo -e "\n${RED}VULNERABLE${NC} — Kernel $KERNEL is affected by CVE-2026-53266."
    if [[ "$MOD_STATUS" == "not available (blacklisted or absent)" ]]; then
        echo -e "${YELLOW}NOTE:${NC} ebt_snat module is not loadable — attack path is blocked at step 3."
    fi
    if [[ "$USERNS" == "disabled" ]]; then
        echo -e "${YELLOW}NOTE:${NC} Unprivileged user namespaces are disabled — attack path is blocked at step 2."
    fi
    echo "[!] Remediation: Update kernel to a fixed version and REBOOT."
    exit 1
fi