Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw in the Linux kernel's ebtables SNAT target allows writing to shared memory pages when rewriting ARP sender hardware addresses without ensuring writability, potentially causing file/memory corruption or denial of service.
A memory corruption flaw was found in the Linux kernel's netfilter subsystem in the ebtables SNAT (Source Network Address Translation) target. When rewriting the ARP sender hardware address (SHA), the code fails to ensure the target memory region is writable before modification. The vulnerable code path uses skb_header_pointer() to read the ARP header, which only provides safe read access, followed by skb_store_bits() to write the new MAC address without verifying writability. When processing ARP packets containing data in nonlinear socket buffer (skb) fragments backed by splice-imported file pages or shared memory, skb_store_bits() will directly write to these shared pages. This can result in corruption of file-backed memory in the page cache, cross-process memory corruption when pages are shared via vmsplice(), or use-after-free conditions if pages are unmapped during processing. An attacker with CAP_NET_ADMIN capability who can configure ebtables rules to perform SNAT with ARP rewriting could exploit this to corrupt file contents, violate process memory isolation, or cause a kernel crash. In virtualization and container environments where bridge networking with ebtables is commonly used, this could potentially lead to privilege escalation or denial of service. The flaw was introduced by commit 63137bc5882a which fixed a small packet regression but inadvertently created this memory safety vulnerability.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:36645 https://access.redhat.com/errata/RHSA-2026:36645
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39082 https://access.redhat.com/errata/RHSA-2026:39082
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39083 https://access.redhat.com/errata/RHSA-2026:39083
*** Bug 2492810 has been marked as a duplicate of this bug. ***
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:70797 https://access.redhat.com/errata/RHSA-2026:70797
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:71233 https://access.redhat.com/errata/RHSA-2026:71233
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:71325 https://access.redhat.com/errata/RHSA-2026:71325
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:71326 https://access.redhat.com/errata/RHSA-2026:71326
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:71327 https://access.redhat.com/errata/RHSA-2026:71327
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:71565 https://access.redhat.com/errata/RHSA-2026:71565
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71606 https://access.redhat.com/errata/RHSA-2026:71606
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:71569 https://access.redhat.com/errata/RHSA-2026:71569
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71601 https://access.redhat.com/errata/RHSA-2026:71601
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71657 https://access.redhat.com/errata/RHSA-2026:71657
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71687 https://access.redhat.com/errata/RHSA-2026:71687
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:72059 https://access.redhat.com/errata/RHSA-2026:72059
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Via RHSA-2026:73732 https://access.redhat.com/errata/RHSA-2026:73732