CVE-2026-53349

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter nf conntrack component where NAT helpers, such as nf nat h323, store a raw pointer to module text in the expectfn variable. The function nf ct helper expectfn unregister() unlinks the callback descriptor but does not clear the expectation table. Consequently, if a module is removed while an expectation is pending, a dangling pointer remains in expectfn pointing to freed module text. When a connection arrives, the init conntrack() function invokes this stale pointer, leading to a system crash. Exploiting this state requires CAP SYS MODULE privileges in the initial user namespace to remove a NAT helper with active expectations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.