The problem in two sentences
Thesnat target of ebtables, the Linux bridge firewall, can rewrite the sender hardware address in ARP packets. The ebt_snat module performs that write through skb_store_bits() without first making sure the target memory range is writable.
When that range is a file page imported with splice(), the kernel writes straight into the page cache. NVD classifies the flaw as an out-of-bounds write (CWE-787), with a CVSS score of 8.8.
Why this one matters
On paper, the flaw needs an unusual setup: an ebtables SNAT rule with ARP rewriting (--snat-arp) on a bridge. Red Hat describes it as requiring “specific bridge netfilter configurations”. That is true, but incomplete.
The attacker can build that setup themselves. All it takes is CAP_NET_ADMIN in the network namespace that owns the bridge. Where unprivileged user namespaces are allowed, any ordinary account gets it with unshare -Urn, inside its own namespace, without touching the host configuration.
The module loads itself. ebt_snat is loaded automatically as soon as a rule needs it. Its absence from lsmod today protects you from nothing.
The write lands in the page cache. Six controlled bytes written into a file page are enough to modify, in memory, a file the attacker can read but not write — a setuid binary, for instance.
These three points come from the public tracker for the flaw, not from the distribution advisories, which do not describe the attack path. CISA does not say how the exploitation it observed was carried out either.
Sizing your exposure
There are two questions: who can run code on the machine, and can they obtainCAP_NET_ADMIN?
As usual with this class of bug, a local foothold is required. The flaw is not remotely exploitable on its own, but it turns a compromised web application or a low-privilege account into control of the machine.
To check whether an unprivileged account can create its own network namespace:
Applying the fix
The upstream fix landed in Linux 7.1-rc7. It makes the ARP address range writable before reading and rewriting it.Debian, Ubuntu and derivatives
AlmaLinux, Rocky Linux and RHEL
Red Hat also ships
kernel-rt-4.18.0-553.143.1.rt7.484.el8_10 for the RHEL 8 real-time kernel (RHSA-2026:39082). Any later version than those listed includes the fix.
Immediate mitigation
Apply this if your fixed kernel is not out yet, or until you are able to reboot.Block the ebt_snat module
Without the module, the ebtables SNAT target no longer exists — and neither does the vulnerable path.
If you run a host that relies on ebtables SNAT rules, this block breaks them. Red Hat offers another route for that case: remove the ARP rewrite option from those rules, or delete the SNAT rules that apply to ARP traffic. List them with
sudo ebtables -t nat -L.Disable unprivileged user namespaces (Debian and Ubuntu)
A second barrier: stop an ordinary account from obtainingCAP_NET_ADMIN in a namespace of its own. This setting exists on Debian and Ubuntu kernels.
On a Kubernetes cluster
Roll the module block out to every node with a privileged DaemonSet. Thepause container keeps the DaemonSet from restart-looping once the initContainer finishes.