CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-30
Weakness: CWE-763

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

Affected products

Linux kernel: from 5.14 before 6.18.33; from 6.19 before 7.0.10 — fixed in 6.18.33, 7.0.10
Red Hat Enterprise Linux: 9.0, 10.0 (and their updates)
Linux: 5.14 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.18.33, 7.0.10; Linux 7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53000 or the next vulnerability affects your stack