CVE-2026-53349 is a vulnerability in Linux Kernel
Published on July 1, 2026
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
NAT helpers such as nf_nat_h323 store a raw pointer to module text in
exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()
only unlinks the callback descriptor and never walks the expectation table,
so an expectation pending at module removal survives with a dangling
exp->expectfn into freed module text.
When the expected connection arrives, init_conntrack() invokes
exp->expectfn(), now a stale pointer into the unloaded module. Reproduced
on a KASAN build by loading the H.323 helpers, creating a Q.931
expectation, unloading nf_nat_h323, then connecting to the expected port:
Oops: int3: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:0xffffffffa06102d1
init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)
nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)
ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)
nf_hook_slow (net/netfilter/core.c:619)
__ip_local_out (net/ipv4/ip_output.c:120)
__tcp_transmit_skb (net/ipv4/tcp_output.c:1715)
tcp_connect (net/ipv4/tcp_output.c:4374)
tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)
__sys_connect (net/socket.c:2167)
Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]
Reaching the dangling state requires CAP_SYS_MODULE in the initial user
namespace to remove a NAT helper that still has live expectations, so this
is a robustness fix; leaving an expectation pointing at freed text is wrong
regardless.
Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and
drops every expectation whose ->expectfn matches the descriptor being torn
down. Call it from each NAT helper's exit path after the existing RCU grace
period, so no expectation outlives the code it points at and no extra
synchronize_rcu() is introduced. With the fix, the same reproducer runs to
completion without the Oops.
Products Associated with CVE-2026-53349
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below fbfde85308b99938a6092c48753214d190ece48d is affected.
- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below 29d8cc44bbdf7b83a1929912214afe6643c1b4f1 is affected.
- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d is affected.
- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below 9d017671dcfcec23321fb7962dea624f9e71ddb1 is affected.
- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below bf8c0b5dd203be94c2ad50e264cec19267c6bd39 is affected.
- Version f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 and below c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 is affected.
- Version 2.6.20 is affected.
- Before 2.6.20 is unaffected.
- Version 6.1.176, <= 6.1.* is unaffected.
- Version 6.6.143, <= 6.6.* is unaffected.
- Version 6.12.94, <= 6.12.* is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.