The Linux kernel's ebtables SNAT target contains an unintended writable ARP sender hardware address rewrite. When the packet data structure is non‑linear, the code writes directly into a fragment’s backing page without ensuring it is writable, creating an out‑of‑bounds write. This can corrupt kernel memory, potentially allowing a local attacker with the ability to create or modify ebtables rules to execute arbitrary code or gain root privileges.

The flaw resides in the Linux kernel, affecting all Linux distributions that run the unpatched kernel. No specific version information is provided, so any host running the kernel before the fix is included.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is notitation requires the ability to add or change ebtables rules on the target host. Because the bug is a memory corruption in the kernel, successful exploitation would likely lead to local privilege escalation or system compromise. The lack of public exploit evidence suggests that exploitation complexity is moderate to high, but the potential impact is severe.