Executive brief
The Linux kernel ebtables networking module contains an out-of-bounds memory write vulnerability that allows an attacker to overwrite memory on the system. An attacker with network access could exploit this flaw to execute arbitrary code, crash the system, or gain unauthorized access to sensitive data. This affects older kernel versions and poses a critical risk to systems still running unsupported versions.
Technical details
This vulnerability is a classic out-of-bounds write (CWE-787) in the ebtables SNAT (Source Network Address Translation) target. The flaw occurs when rewriting an ARP (Address Resolution Protocol) sender hardware address into a nonlinear socket-buffer fragment that is backed by a splice-imported file page. The vulnerable code fails to properly validate buffer boundaries before writing, allowing an attacker to overwrite adjacent kernel memory. The attack is network-accessible and does not require prior authentication; an attacker can craft malicious ARP packets to trigger the condition. Successful exploitation could lead to kernel memory corruption, denial of service, or arbitrary code execution with kernel privileges. The vulnerability is known to be actively exploited in the wild. Patched kernel versions are available and users are advised to upgrade immediately.
Affected products
- Linux Linux Kernel Multiple versions (end-of-life and end-of-service)
Timeline
- 2026-09-18: disclosed
- exploited: Known to be actively exploited in the wild