FlawOpen

flawopen.com/Teardowns/cve-2026-53266-linux-ebtables-arp-shared-page-write

● CVE-2026-53266 · CVSS 8.8 · High
FlawOpen Security Research

Linux CVE-2026-53266: ebtables ARP Writeability

A missing writeability check in Linux bridge netfilter’s ebt_snat path could let an ARP rewrite modify a shared fragment page. The upstream fix makes the ARP sender-address range writable before the write.

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
💡 Plain English Explainer (ELI5)

Think of a packet as a document whose first page is readable but whose attached sheet is shared with someone else. Reading the ARP header did not give the kernel exclusive permission to change the later address field. The fix first makes that exact range private and writable, then performs the rewrite.

Core Concepts & Subsystem Terms

skb
Linux packet buffer that may store bytes in separate fragments.
ARP SHA
The sender hardware-address field in an ARP packet.
Nonlinear fragment
Packet bytes outside the skb linear area, possibly backed by a shared page.
Weakness classification
The Linux CVE record does not assign a CWE. Avoid labeling this as an out-of-bounds write: the documented problem is a write into a shared backing page.
CWE-825
CWE-825 — Expired Pointer Dereference. Red Hat uses this category for the stale/shared-page write condition; Linux’s CVE record does not assign a CWE.

Framework mappings

Root Cause Analysis

In ebt_snat_tg, skb_header_pointer() safely obtains the ARP header, but does not make the later sender hardware address (SHA) bytes writable. skb_store_bits() then writes at an offset relative to skb->data. If those bytes remain in a nonlinear fragment backed by a splice-imported file page, the write can alter data through the shared page. The upstream fix calls skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN) before inspecting the ARP header and before the store. The existing skb_ensure_writable(skb, 0) for the Ethernet source address is intentional: at these hooks, eth_hdr(skb) refers to the MAC header, while skb->data begins at the payload. Expanding that earlier check to ETH_HLEN would check the wrong bytes and could regress small packets. CVSS 3.1 is 8.8 High (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H); this is a local kernel vulnerability, not a remotely reachable network flaw by itself. The Linux CVE record does not assign a CWE. Avoid labeling this as an out-of-bounds write: the documented problem is a write into a shared backing page. Red Hat separately classifies this issue as CWE-825 (Expired Pointer Dereference); the Linux CVE record itself assigns no CWE.

Step-by-Step Attack Flow

Step 1

The bridge SNAT target handles the packet

For ARP packets, ebt_snat may also rewrite the sender hardware address after changing the Ethernet source address. The Linux CVE record rates this AV:L/PR:L/UI:N: it requires a low-privilege local attacker with access to the relevant bridge/netfilter setup; remote ARP traffic alone is not an unauthenticated exploit path.

Step 2

The optional ARP sender-address rewrite runs

The SHA write uses an offset from skb->data, separate from the Ethernet MAC-header coordinate system.

Step 3

A safe header read is mistaken for a write guarantee

skb_header_pointer() provides a safe read view but does not make the later SHA destination writable.

Step 4

The write may modify a shared backing page

The documented vulnerable condition is a nonlinear fragment backed by a splice-imported file page; the write can modify that shared page.

Step 5

The fix makes the range writable first

The patch ensures the ARP header and six-byte SHA range is writable before reading and writing; failure drops the packet.

Source Code: Flaw vs. Secure Implementation

Focused excerpt from net/bridge/netfilter/ebt_snat.c, not a standalone function. The upstream commit adds the three-line guard immediately before the ARP header read. It covers the ARP header plus six SHA bytes; if a writable copy cannot be obtained, the target drops the packet. The unrelated Ethernet MAC-header check remains unchanged.

Source excerpt: net/bridge/netfilter/ebt_snat.c — ebt_snat_tg

UNPATCHED FLAW
/* Excerpt: net/bridge/netfilter/ebt_snat.c */
ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
if (ap == NULL)
    return EBT_DROP;
if (ap->ar_hln != ETH_ALEN)
    goto out;

/* The later SHA destination has no writable-range guard. */
if (skb_store_bits(skb, sizeof(_ah), info->mac, ETH_ALEN))
    return EBT_DROP;
HARDENED SECURE PATCH
/* Upstream fix: make the ARP header + SHA range writable first. */
if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN))
    return EBT_DROP;

ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
if (ap == NULL)
    return EBT_DROP;
if (ap->ar_hln != ETH_ALEN)
    goto out;

if (skb_store_bits(skb, sizeof(_ah), info->mac, ETH_ALEN))
    return EBT_DROP;

Engineering & System Hardening Checklist

Sources