CVE-2026-53267

A flaw was found in the Linux kernel's netfilter subsystem. A local attacker can exploit this vulnerability by creating specially crafted netfilter rules. This can lead to a memory corruption issue, where data on the kernel's memory stack is overwritten. Successful exploitation could result in information disclosure or potentially allow the attacker to gain elevated privileges.

nft_ct_get_eval() can treat a per CPU template conntrack object as a real conntrack entry after a rule first attaches a template ct and then reads ct original address fields from the same skb. In that state nf_ct_l3num(ct) can be 0 and the old code may take the 16 byte address copy path even when the destination register was validated for a shorter value. With dreg set near the end of struct nft_regs, this becomes an out of bounds write past the nft_regs area on the kernel stack. For the CVSS the PR:L is used because reliable triggering requires local ability to install crafted nftables rules, typically CAP_NET_ADMIN or delegated network administration in a namespace. Impact is at least local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.