A memory corruption flaw was found in the Linux kernel's netfilter subsystem
  in the ebtables SNAT (Source Network Address Translation) target. When
  rewriting the ARP sender hardware address (SHA), the code fails to ensure
  the target memory region is writable before modification. The vulnerable
  code path uses skb_header_pointer() to read the ARP header, which only
  provides safe read access, followed by skb_store_bits() to write the new
  MAC address without verifying writability.

  When processing ARP packets containing data in nonlinear socket buffer (skb)
  fragments backed by splice-imported file pages or shared memory,
  skb_store_bits() will directly write to these shared pages. This can result
  in corruption of file-backed memory in the page cache, cross-process memory
  corruption when pages are shared via vmsplice(), or use-after-free conditions
  if pages are unmapped during processing.

  An attacker with CAP_NET_ADMIN capability who can configure ebtables rules
  to perform SNAT with ARP rewriting could exploit this to corrupt file
  contents, violate process memory isolation, or cause a kernel crash. In
  virtualization and container environments where bridge networking with
  ebtables is commonly used, this could potentially lead to privilege escalation
  or denial of service. The flaw was introduced by commit 63137bc5882a which
  fixed a small packet regression but inadvertently created this memory safety
  vulnerability.

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:36645 https://access.redhat.com/errata/RHSA-2026:36645

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39082 https://access.redhat.com/errata/RHSA-2026:39082

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39083 https://access.redhat.com/errata/RHSA-2026:39083