VulnerabilityPublished 1 Jul 2026Updated 6 Nov 2026

CVE-2026-53349: Linux kernel · netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fbfde85308b99938a6092c48753214d190ece48d : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in fbfde85308b99938a6092c48753214d190ece48d, f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d, c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < fbfde85308b99938a6092c48753214d190ece48d	Fixed in fbfde85308b99938a6092c48753214d190ece48d
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d	Fixed in f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < c3009418f9fa1dcb3eb86f4d8c92583537b5faa3	Fixed in c3009418f9fa1dcb3eb86f4d8c92583537b5faa3
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < bf8c0b5dd203be94c2ad50e264cec19267c6bd39	Fixed in bf8c0b5dd203be94c2ad50e264cec19267c6bd39
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < 29d8cc44bbdf7b83a1929912214afe6643c1b4f1	Fixed in 29d8cc44bbdf7b83a1929912214afe6643c1b4f1
LinuxLinux	Affected ≥ f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4, < 9d017671dcfcec23321fb7962dea624f9e71ddb1	Fixed in 9d017671dcfcec23321fb7962dea624f9e71ddb1

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops.

References

Community reviews

Loading reviews…