High 7.8Published Jun 24, 2026

CVE-2026-53000netfilter: nat: use kfree_rcu to release ops

Updated under an hour ago (Oct 27, 2026, 11:00 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-763
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before ede973d62d26d9c550269af05366ab9e30fc92ee; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 050f98e56782b14677c5bae50800e60775bbf6bb; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 32fdd2e38e7435a368d88f5977a7d6585ebc8b0e; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 3c7511f38ab511b791196b13ae48bf4973bf7dfd; from e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 before 6eda0d771f94267f73f57c94630aa47e90957915	CNA record
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus	from 0:6.12.0-55.98.1.el10_0 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 9 redhat:enterprise_linux	from 0:5.14.0-687.45.1.el9_8 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus	from 0:5.14.0-570.141.1.el9_6 not affected	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.14 before 6.18.33; from 6.19 before 7.0.10	NVD
redhat enterprise_linux redhat:enterprise_linux	9.0; 10.0	NVD

References

References

https://git.kernel.org/stable/c/ede973d62d26d9c550269af05366ab9e30fc92ee
https://git.kernel.org/stable/c/050f98e56782b14677c5bae50800e60775bbf6bb
https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e	patch
https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd	patch
https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915	patch
https://access.redhat.com/errata/RHSA-2026:55445
https://access.redhat.com/errata/RHSA-2026:64808
https://access.redhat.com/errata/RHSA-2026:67720
https://access.redhat.com/errata/RHSA-2026:68100
https://access.redhat.com/security/cve/CVE-2026-53000	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.