The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-53266 to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation against Linux systems. The high-severity vulnerability resides in the Linux kernel netfilter bridge subsystem (net/bridge/netfilter/ebt_snat.c), where the ebtables SNAT target rewrites Address Resolution Protocol (ARP) sender hardware addresses. While primary SNAT logic calls skb_ensure_writable(), the ARP rewrite routine invokes skb_store_bits() without verifying memory writability. When network packets utilize nonlinear socket buffer (skb) fragments linked to splice()-imported file pages, the kernel writes directly into read-only page-cache memory, enabling local unprivileged users to corrupt host files and escalate to root.

Active exploitation involves attackers leveraging this memory corruption primitive for container breakouts and local privilege escalation, circumventing conventional file-integrity monitoring. CISA has mandated remediation under Binding Operational Directive (BOD) 26-04. Upstream maintainers patched stable kernel branches by validating buffer writability before ARP header execution, and distributions including Red Hat, Ubuntu, and SUSE have released updated packages requiring immediate system reboots.

Why it matters:

• Page-cache subversion bypasses container sandboxing: Modifying shared page-cache memory directly via kernel socket buffers circumvents container namespaces, read-only root filesystems, and unprivileged user mappings, transforming localized network bridge operations into arbitrary root write primitives across host memory.
• Urgent distribution upgrades and reboot orchestration: System administrators and cloud infrastructure teams must prioritize rolling kernel updates across cluster worker nodes and virtualized hosts, ensuring patched distributions are actively booted to eradicate exploitation vectors.