CVE-2026-53266
HIGH 8.8 KNOWN EXPLOITED ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
ACTIVELY EXPLOITED
Confirmed exploited in the wild — in CISA KEV since 2026-09-18. Patch or mitigate now.
Exploitation likelihood
0.9%chance of exploitation in 30 days · 61st percentile
● In CISA KEV (2026-09-18)○ Catalogued PoC◆ SSVC: exploitation active, automatable no
Impact if exploited
8.8CVSS 3.1 · HIGH · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-787: Out-of-bounds Write
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 2358 vendor product statements; 2326 omitted. Read the full vendor advisory.
kernel-0:6.12.0-231.20.el10nv.aarch64 as a component of NVIDIA for RHEL 10 · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-tools-debuginfo-0:3.10.0-1160.164.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-debuginfo-0:6.12.0-211.59.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-rt-debug-debuginfo-0:5.14.0-427.152.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-zfcpdump-debuginfo-0:5.14.0-687.23.1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-core-0:6.12.0-211.59.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-tools-0:4.18.0-553.143.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-0:4.18.0-372.217.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-tools-libs-0:4.18.0-477.169.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-64k-debug-core-0:5.14.0-427.152.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-modules-core-0:5.14.0-570.143.1.el9_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-debuginfo-0:6.12.0-55.106.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_0?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-debuginfo-0:5.14.0-687.23.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-rt-modules-0:5.14.0-570.143.1.el9_6.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-rt-devel-0:4.18.0-553.143.1.rt7.484.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
python3-perf-debuginfo-0:5.14.0-687.23.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
kernel-rt as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-core
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-core
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-devel
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-kvm
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-core
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-internal
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-partner
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-devel-matched
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-kvm
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-extra
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-internal
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt-selftests-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-selftests-internal
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
kernel-rt.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt?arch=src
- workaround: Disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- none available: Affected
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/suominen/CVE-2026-53266
Tracking CVE-2026-53266, the Linux kernel ebtables SNAT ARP-rewrite page-cache write
PoC-in-GitHub · CVE-2026-53266
PoC-in-GitHub · CVE-2026-53266 · Updated 2026-09-28T08:35:56Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-09-18T00:00:00Z
Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-53266 · Updated 2026-09-18T00:00:00Z - VulnCheck KEV · 2026-09-18T00:00:00ZVulnCheck KEV · CVE-2026-53266
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 5.4.73 and < 5.5 |
| Linux | Linux Kernel | ≥ 5.8.17 and < 5.9 |
| Linux | Linux Kernel | ≥ 5.9.2 and < 5.10.259 |
| Linux | Linux Kernel | ≥ 5.11 and < 5.15.210 |
| Linux | Linux Kernel | ≥ 5.16 and < 6.1.176 |
| Linux | Linux Kernel | ≥ 6.2 and < 6.6.143 |
| Linux | Linux Kernel | ≥ 6.7 and < 6.12.94 |
| Linux | Linux Kernel | ≥ 6.13 and < 6.18.36 |
| Linux | Linux Kernel | ≥ 6.19 and < 7.0.13 |
| Linux | Linux Kernel | 7.1 |
| Linux | Linux Kernel | 7.1 |
| Linux | Linux Kernel | 7.1 |
| Linux | Linux Kernel | 7.1 |
| Linux | Linux Kernel | 7.1 |
| Linux | Linux Kernel | 7.1 |
All CVSS metrics
- HIGH 8.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - HIGH 8.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
Patches & mitigations
- https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0 CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093 CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 CVE record · Linux · Updated 2026-08-05T12:34:43.383Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580
Advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266 CVE record · CISA-ADP · Updated 2026-09-19T03:56:22.274Z
NVD · CVE-2026-53266 · Updated 2026-09-19T04:17:53.580 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53266.json Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39217 EUVD · EUVD-2026-39217
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-53266 · Updated 2026-09-18T00:00:00Z
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-53266 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2485368 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-53266 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-53266 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53266-6162@gregkh/T/#u Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:72059 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71687 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71233 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71569 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:36645 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:39083 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:70797 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71325 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71327 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71326 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:39082 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:73732 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71657 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71601 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71565 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://access.redhat.com/errata/RHSA-2026:71606 Red Hat · CVE-2026-53266 · Updated 2026-09-30T14:44:44+00:00
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-53266 · Updated 2026-09-18T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS