In the Linux kernel

CVE-2026-53266 is an out-of-bounds write in the Linux kernel's netfilter bridge subsystem. When the ebtables SNAT target rewrites the ARP sender hardware address, it calls skb_store_bits() without first calling skb_ensure_writable() on the ARP payload region. If the packet buffer is nonlinear — backed by a splice-imported file page — the write goes directly into a potentially read-only or shared page, corrupting kernel memory. The bug was introduced by commit 63137bc5882a in kernel 5.10 and affects every stable branch from 5.10 through 6.18. Fixed versions are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, and 6.18.36.

The vendor's CVSS 8.8 HIGH with PR:L (Privileges Required: Low) significantly overstates the real-world attack surface. Triggering this bug requires the ability to configure ebtables rules with SNAT and ARP rewriting, which demands CAP_NET_ADMIN — a capability that is dropped by default in Docker, Kubernetes, and every hardened Linux deployment. CAP_NET_ADMIN is functionally equivalent to PR:H (Privileges Required: High) in the CVSS model, which alone would drop the base score from 8.8 to roughly 8.2, and once you factor in the additional requirement of engineering a nonlinear skb via vmsplice() or similar with the right page-backed fragment layout, the practical exploitability drops further. There is no public PoC, no known in-the-wild exploitation, and the EPSS score of 0.00121 reflects the security community's consensus that weaponization is unlikely near-term.

Why this verdict

• CAP_NET_ADMIN gate: The real privilege requirement is CAP_NET_ADMIN, not generic low-privilege access. This capability is dropped by default in Docker (--cap-drop=ALL best practice), Kubernetes Restricted PSS, and most enterprise Linux configurations. The vendor's PR:L label inflates the CVSS by ~0.6 points.
• No weaponization: Zero public PoCs, zero in-the-wild exploitation, and an EPSS of 0.00121. The skb layout engineering required to reach the vulnerable code path is undocumented and non-trivial.
• Narrow write primitive: The corruption window is 6 bytes (a MAC address) at a kernel-determined offset. Converting this to reliable code execution requires bypassing KASLR, SMAP, SMEP, and (on modern kernels) CFI — a research-grade exploit development effort.
• Role multiplier: The Linux kernel is canonically a high-value component running on container hosts, hypervisors, and infrastructure nodes. *However*, the attack path requires CAP_NET_ADMIN + ebtables + bridge interface + splice-engineered skbs — a conjunction of conditions that fails on >95% of container hosts (CAP_NET_ADMIN alone is absent in default configs). On KVM hypervisors, the host kernel is not typically exposed to guest-controlled ebtables rules. The theoretical worst-case (container escape on a Kubernetes node) is real but requires a non-default, explicitly insecure pod configuration. This prevents the HIGH floor from activating — the conjunction of prerequisites reduces the high-value-role reachable population below the 1% threshold for floor enforcement.

Why not higher?

Upgrading to HIGH would require either active exploitation evidence, a public PoC demonstrating reliable privilege escalation, or a realistic attack path that does not depend on CAP_NET_ADMIN. None of these conditions are met. The conjunction of CAP_NET_ADMIN + nonlinear skb engineering + 6-byte write weaponization represents at least three independent friction points, each of which individually narrows the exploitable population.

Why not lower?

Downgrading to LOW would undercount the theoretical container-escape scenario on misconfigured Kubernetes nodes. The Scope Changed (S:C) designation is legitimate — if exploited, this crosses security boundaries. Additionally, the bug is in a core kernel subsystem (netfilter) that processes network traffic at high frequency, and kernel memory corruption bugs have a history of eventually being weaponized even when initial assessments are pessimistic.

1. Audit and remove CAP_NET_ADMIN from all non-essential containers — The single most effective mitigation. Review all Kubernetes pod specs and Docker run commands for CAP_NET_ADMIN. Remove it from any workload that does not explicitly require it (which is >99% of application pods). This completely eliminates the attack surface for containerized exploitation. Deploy within the 365-day noisgate remediation SLA window, but prioritize this audit within 30 days as good hygiene.
2. Enforce Kubernetes Pod Security Standards (Restricted profile) — The Restricted PSS profile drops all capabilities including CAP_NET_ADMIN by default. Apply it at the namespace level for all application workloads. This prevents any container from reaching the vulnerable code path.
3. Enable kernel KASAN in staging/canary environments — Kernel Address Sanitizer will detect the out-of-bounds write at runtime and panic the kernel, providing early detection if any code path triggers the bug. Not suitable for production due to performance overhead, but valuable for validating patch coverage.
4. Monitor ebtables module loads via auditd — Add audit rules for NETFILTER and ebtables module loading events. Any unexpected ebtables activity on hosts without bridge networking is an anomaly worth investigating: auditctl -w /sbin/ebtables -p x -k ebtables_exec.

Run this script on each target Linux host as root (or with sudo). It checks the running kernel version against known-fixed versions. Invoke: sudo bash check_cve_2026_53266.sh

#!/bin/bash
# CVE-2026-53266 Checker — netfilter ebtables SNAT ARP rewrite OOB write
# Run as root on target Linux host
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Checking CVE-2026-53266 on kernel: $KERNEL"

# Extract major.minor.patch
VER=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
  echo "UNKNOWN — could not parse kernel version"
  exit 2
fi

# Version comparison helper
ver_gte() {
  # Returns 0 if $1.$2.$3 >= $4.$5.$6
  local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
  if [ "$a1" -gt "$b1" ]; then return 0; fi
  if [ "$a1" -lt "$b1" ]; then return 1; fi
  if [ "$a2" -gt "$b2" ]; then return 0; fi
  if [ "$a2" -lt "$b2" ]; then return 1; fi
  if [ "$a3" -ge "$b3" ]; then return 0; fi
  return 1
}

# Bug introduced in 5.10 (commit 63137bc5882a)
# Not affected: < 5.10
if [ "$MAJOR" -lt 5 ] || { [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 10 ]; }; then
  echo "PATCHED — kernel $VER predates the vulnerable commit (introduced in 5.10)"
  exit 0
fi

# Fixed versions per stable branch:
# 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36
PATCHED=false

case "${MAJOR}.${MINOR}" in
  5.10) ver_gte $MAJOR $MINOR $PATCH 5 10 259 && PATCHED=true ;;
  5.15) ver_gte $MAJOR $MINOR $PATCH 5 15 210 && PATCHED=true ;;
  5.1[1-4]|5.1[6-9]|5.[2-9]*)
    # 5.11-5.14, 5.16-5.x: no stable fix backported; check if >= 6.1.176
    PATCHED=false ;;
  6.1)  ver_gte $MAJOR $MINOR $PATCH 6 1 176 && PATCHED=true ;;
  6.6)  ver_gte $MAJOR $MINOR $PATCH 6 6 143 && PATCHED=true ;;
  6.12) ver_gte $MAJOR $MINOR $PATCH 6 12 94  && PATCHED=true ;;
  6.18) ver_gte $MAJOR $MINOR $PATCH 6 18 36  && PATCHED=true ;;
  6.19|6.[2-9][0-9]|[7-9].*)
    # Kernel newer than 6.18 — likely includes the fix
    echo "PATCHED — kernel $VER is newer than all affected branches (assuming fix included)"
    exit 0 ;;
  *)
    # Unsupported/EOL branch between known fixed versions
    PATCHED=false ;;
esac

if $PATCHED; then
  echo "PATCHED — kernel $VER is at or above the fix for this branch"
  exit 0
else
  echo "VULNERABLE — kernel $VER is in the affected range for CVE-2026-53266"
  echo "  Fix versions: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36"
  exit 1
fi

Sources

1. Ubuntu Security Advisory — CVE-2026-53266
2. Red Hat Bugzilla — CVE-2026-53266
3. SUSE CVE Entry — CVE-2026-53266
4. NVD Detail — CVE-2026-53266
5. linux-cve-announce Disclosure — Ratatoskr
6. Netfilter Patch Series — Ratatoskr
7. OpenCVE — CVE-2026-53266