Hypervisor & Bridge Security: Netfilter ebtables Memory Corruption

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-53266 to its Known Exploited Vulnerabilities (KEV) catalog, warning that adversaries are actively weaponizing an out-of-bounds memory write defect within the Linux Kernel Netfilter Bridge subsystem. Carrying a severity score of CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the vulnerability allows local unprivileged users who can create network namespaces (such as container runtimes) to corrupt kernel memory and achieve root execution on host hypervisors.

The Ethernet bridge tables (ebtables) utility enables link-layer (OSI Layer 2) frame filtering across Linux network bridge devices. Deployed extensively in cloud hypervisors (KVM, OpenStack) and container networking interfaces (CNI plugins like Flannel and Calico), ebtables rewrites MAC addresses and routes traffic between virtual machines and host adapters.

Root Cause Analysis: Unbounded ARP Hardware Address Copy (CWE-787)

The vulnerability exists in net/bridge/netfilter/ebt_snat.c within the Source NAT (SNAT) target processing function:

  • Fixed-Length Buffer Assumption: When rewriting ARP headers on bridged packets, the kernel copies the new hardware source address using an implicit 6-byte Ethernet assumption (ETH_ALEN).
  • Variable-Length Hardware Headers: When a malformed ARP request originating from an encapsulated tunnel or custom interface specifies a hardware address length larger than standard Ethernet (such as InfiniBand or raw tunnel devices), the copy operation exceeds the allocated buffer boundary in the socket buffer structure (sk_buff).
  • Heap Overwrite & Execution Takeover: The out-of-bounds write corrupts adjacent pointers within the sk_buff slab cache (skbuff_head_cache), allowing threat actors to manipulate memory freelists and execute arbitrary shellcode in the kernel execution space.
// Vulnerable Kernel Logic in ebt_snat.c:
static unsigned int
ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
    const struct ebt_nat_info *info = par->targinfo;
    struct arphdr *ah;

    // Assumes standard 6-byte MAC address without validating ah->ar_hln
    memcpy(arp_hdr_src_mac(ah), info->mac, ETH_ALEN); // OOB Write if header length differs!
    return info->target;
}

Remediation Matrix & Kernel Hardening

Defensive Layer Technical Control Implementation Directive
Kernel Update Apply Netfilter Patch Upgrade Linux kernel to patched versions that validate ar_hln == ETH_ALEN before copying hardware addresses.
Migration Adopt nftables Migrate legacy ebtables rulesets to the modern nftables bridge family, which implements strict packet boundary checking.
Namespace Lockdown Restrict User Namespaces Set sysctl -w kernel.unprivileged_userns_clone=0 to prevent unprivileged users from creating network namespaces required to manipulate ebtables.