CVE-2026-53000netfilter: nat: use kfree_rcu to release ops
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-763
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 32fdd2e38e7435a368d88f5977a7d6585ebc8b0e; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 3c7511f38ab511b791196b13ae48bf4973bf7dfd; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 6eda0d771f94267f73f57c94630aa47e90957915 | CNA record |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:6.12.0-55.98.1.el10_0 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 9 redhat:enterprise_linux | from 0:5.14.0-687.45.1.el9_8 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:5.14.0-570.141.1.el9_6 not affected | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.14 before 6.18.33; from 6.19 before 7.0.10 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 9.0; 10.0 | NVD |
References
- https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0epatch
- https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfdpatch
- https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915patch
- https://access.redhat.com/errata/RHSA-2026:55445
- https://access.redhat.com/errata/RHSA-2026:64808
- https://access.redhat.com/errata/RHSA-2026:67720
- https://access.redhat.com/errata/RHSA-2026:68100
- https://access.redhat.com/security/cve/CVE-2026-53000third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2492273third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.jsonthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.