Loading vulnerability…
CVE-2026-53266 is a Linux kernel netfilter bridge vulnerability in the ebtables SNAT target during optional ARP sender hardware address rewriting. At bridge ebtables hooks, the Ethernet header is handled via the MAC header while skb->data points to the Ethernet payload, so the existing writability check intentionally avoided validating the Ethernet header region. However, the ARP sender hardware address rewrite path performs a write through skb_store_bits() at an offset relative to skb->data after only safely reading the ARP header. The affected logic did not ensure that the ARP sender hardware address range was writable before modifying it. As a result, when that range resided in a non-linear skb fragment backed by a splice-imported file page, the kernel could copy the replacement MAC address directly into the backing fragment page. The fix ensures the ARP sender hardware address range is made writable before the ARP header is read and before skb_store_bits() is invoked.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel netfilter/ebtables vulnerability where the SNAT target writes to shared memory pages during ARP hardware address rewrite.
A Linux kernel netfilter/ebtables vulnerability where the SNAT target writes to shared memory pages during ARP hardware address rewriting.
A Linux kernel netfilter/ebtables vulnerability where the SNAT target writes to shared memory pages during ARP hardware address rewrite.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.