ARP Header Manipulation Vulnerability in Linux Kernel Products

CVE-2026-53266

What is CVE-2026-53266?

A vulnerability in the Linux kernel's netfilter component allows for unauthorized manipulation of ARP sender hardware addresses. The issue arises from the way the ebtables SNAT target manages Ethernet source address rewrites via skb_ensure_writable(). If the ARP sender hardware address range is not made writable before operations, it could allow malicious actors to manipulate ARP headers, leading to potential network intrusions or address spoofing attacks. It is crucial to ensure that the ARP SHA range is writable to maintain the integrity of network communications.

References