Red Hat Security Advisory: kernel security update
Affects Linux kernelSource GCVE Database
Exploited in the wild · KEV due 21 Sep 2026 : apply the vendor's fix or mitigations to Linux kernel now.
Data as of 29 Oct 2026, 07:27 UTC
Actively exploited
High severity · CVSS not yet scored by NVD
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 23 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 5 days before disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 5 days before disclosure
KEV remediation due
US federal deadline
, 2 days before disclosure
CVE published
on cve.org
, t = 0
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 (opens in a new tab)
- git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b (opens in a new tab)
- git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0 (opens in a new tab)
- git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b (opens in a new tab)
- git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093 (opens in a new tab)
- git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d (opens in a new tab)
- git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 (opens in a new tab)
- git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-53266 (opens in a new tab)
Description
A security vulnerability (CVE-2026-53266) exists in the Linux kernel's netfilter ebtables SNAT target, where it writes to shared memory pages during ARP hardware address rewrite. This flaw affects Red Hat Enterprise Linux 8.6 variants and has been rated with high severity. The vulnerability is known to be exploited in the wild. Red Hat has released a security update to address this issue and recommends applying the update and rebooting the system to mitigate the risk.