PT-2026-54817 · Linux · Linux Kernel

CVE-2026-53349 · Published 2026-07-01 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter nf conntrack component where NAT helpers, such as nf nat h323, store a raw pointer to module text in the expectfn variable. The function nf ct helper expectfn unregister() unlinks the callback descriptor but does not clear the expectation table. Consequently, if a module is removed while an expectation is pending, a dangling pointer remains in expectfn pointing to freed module text. When a connection arrives, the init conntrack() function invokes this stale pointer, leading to a system crash. Exploiting this state requires CAP SYS MODULE privileges in the initial user namespace to remove a NAT helper with active expectations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-53349

ECHO-E689-52D0-2F69

Affected Products

Linux Kernel

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53349.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-53349 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53349 · Vendor Advisory
• https://git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-53349 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-53349 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-53349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53349 · Security Note
• https://ubuntu.com/security/CVE-2026-53349 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-53349 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-53349 · Vendor Advisory
• https://git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1 · Patch
• https://git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d · Patch
• https://git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 · Patch
• https://git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39 · Patch