Red Hat Security Advisory: kernel security update
Affects Linux kernelSource GCVE Database
Exploited in the wild · KEV due 21 Sep 2026 : apply the vendor's fix or mitigations to Linux kernel now.
Data as of 29 Oct 2026, 07:27 UTC
Actively exploited
High severity · CVSS not yet scored by NVD
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 6 days before disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 6 days before disclosure
KEV remediation due
US federal deadline
, 3 days before disclosure
CVE published
on cve.org
, t = 0
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 (opens in a new tab)
- git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b (opens in a new tab)
- git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0 (opens in a new tab)
- git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b (opens in a new tab)
- git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093 (opens in a new tab)
- git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d (opens in a new tab)
- git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 (opens in a new tab)
- git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-53266 (opens in a new tab)
Description
A security vulnerability in the Linux kernel's netfilter ebtables SNAT target allows writing to shared memory pages during ARP hardware address rewrite. This flaw, tracked as CVE-2026-53266, affects Red Hat Enterprise Linux 8.8 variants. The vulnerability has been rated as having an important security impact by Red Hat and is known to be exploited in the wild. A kernel update addressing this issue is available and requires a system reboot to take effect.