Critical Linux Kernel Vulnerability CVE-2026-53266 Exploited

• •CVE-2026-53266 allows local privilege escalation and memory corruption in Linux kernel.
• •Active exploitation confirmed; systems with bridge netfilter rules are at highest risk.
• •Immediate mitigation recommended, including disabling specific ARP rules.

CVE-2026-53266 is a critical vulnerability in the Linux kernel's netfilter bridge ebtables SNAT module, allowing local attackers to modify memory during ARP address rewrites. This flaw can lead to privilege escalation, memory corruption, or denial of service, particularly affecting systems with specific bridge netfilter configurations. The vulnerability was published on June 25, 2026, and was added to the CISA KEV catalog for active exploitation on September 18, 2026. Attackers can exploit this flaw by creating crafted ARP traffic after gaining limited local control with network-administration capabilities. The vulnerability poses significant risks to shared infrastructure, including container hosts and network appliances. Mitigation steps include disabling ARP hardware address rewriting and monitoring for anomalous ARP traffic. Urgent action is advised for affected systems.