Linux Kernel: netfilter NAT hook ops kfree_rcu misuse
CVE-2026-53000 Published on June 24, 2026
netfilter: nat: use kfree_rcu to release ops
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nat: use kfree_rcu to release ops
Florian Westphal says:
"Historically this is not an issue, even for normal base hooks: the data
path doesn't use the original nf_hook_ops that are used to register the
callbacks.
However, in v5.14 I added the ability to dump the active netfilter
hooks from userspace.
This code will peek back into the nf_hook_ops that are available
at the tail of the pointer-array blob used by the datapath.
The nat hooks are special, because they are called indirectly from
the central nat dispatcher hook. They are currently invisible to
the nfnl hook dump subsystem though.
But once that changes the nat ops structures have to be deferred too."
Update nf_nat_register_fn() to deal with partial exposition of the hooks
from error path which can be also an issue for nfnetlink_hook.
Vulnerability Analysis
CVE-2026-53000 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Release of Invalid Pointer or Reference
The application attempts to return a memory resource to the system, but calls the wrong release function or calls the appropriate release function incorrectly.
Products Associated with CVE-2026-53000
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-53000 are published in these products:
Affected Versions
Linux:- Version e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 and below 32fdd2e38e7435a368d88f5977a7d6585ebc8b0e is affected.
- Version e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 and below 3c7511f38ab511b791196b13ae48bf4973bf7dfd is affected.
- Version e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 and below 6eda0d771f94267f73f57c94630aa47e90957915 is affected.
- Version 5.14 is affected.
- Before 5.14 is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
- Version 0:6.12.0-55.98.1.el10_0 and below * is unaffected.
- Version 0:5.14.0-687.45.1.el9_8 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.