CVE-2026-53267

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An issue exists in the netfilter nft ct component where the system fails to properly handle template connection tracking (ct) during evaluation. When a rule sets a connection tracking zone via nft ct set zone eval(), a per-cpu template ct is attached. A subsequent call to nft ct get eval() may treat this template as a real connection tracking entry, leading to a 16-byte memory copy. Depending on the destination register value, this can result in a stack overflow past struct nft regs or the silent corruption of adjacent registers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.