CVE-2026-53000 Details
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.
A vulnerability in the Linux kernel's netfilter component, specifically within the NAT (Network Address Translation) subsystem, has been addressed. This issue arises from the improper management of hook operation structures, which are crucial for the NAT functionality. In versions prior to 5.14, the NAT hooks were indirectly called from a central dispatcher, making them invisible to the netfilter hook dump subsystem. However, the recent addition of a userspace hook dumping feature exposed this oversight. The vulnerability could lead to issues when the NAT operations are eventually made visible to the hook dump subsystem, requiring a deferred handling that was not previously accounted for.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:55445 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:64808 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:67720 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:68100 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-53000 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492273 | redhat-SADP | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json | redhat-SADP | Third Party Advisory |
| https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e | kernel.org | Patch |
| https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd | kernel.org | Patch |
| https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-763 | Release of Invalid Pointer or Reference | [email protected] |
| CWE-763 | Release of Invalid Pointer or Reference | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.14, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
| redhat enterprise linux | 9.0 10.0 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | redhat-SADP |
| Sep 16, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | kernel.org |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | New CVE Received | kernel.org |