{"api_version":"1","generated_at":"2026-07-07T15:24:38+00:00","cve":"CVE-2026-53349","urls":{"html":"https://cve.report/CVE-2026-53349","api":"https://cve.report/api/cve/CVE-2026-53349.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-53349","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53349"},"summary":{"title":"netfilter: nf_conntrack: destroy stale expectfn expectations on unregister","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp->expectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp->expectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n  init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n  nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n  ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n  nf_hook_slow (net/netfilter/core.c:619)\n  __ip_local_out (net/ipv4/ip_output.c:120)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n  tcp_connect (net/ipv4/tcp_output.c:4374)\n  tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n  __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose ->expectfn matches the descriptor being torn\ndown. Call it from each NAT helper's exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-01 14:16:43","updated_at":"2026-07-01 14:16:43"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3","name":"https://git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9d017671dcfcec23321fb7962dea624f9e71ddb1","name":"https://git.kernel.org/stable/c/9d017671dcfcec23321fb7962dea624f9e71ddb1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d","name":"https://git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1","name":"https://git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d","name":"https://git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39","name":"https://git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53349","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53349","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 fbfde85308b99938a6092c48753214d190ece48d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 29d8cc44bbdf7b83a1929912214afe6643c1b4f1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 9d017671dcfcec23321fb7962dea624f9e71ddb1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 bf8c0b5dd203be94c2ad50e264cec19267c6bd39 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.20","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.176 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.143 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.94 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.36 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.13 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"53349","cve":"CVE-2026-53349","epss":"0.001610000","percentile":"0.055960000","score_date":"2026-07-04","updated_at":"2026-07-05 00:02:27"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_helper.h","net/ipv4/netfilter/nf_nat_h323.c","net/netfilter/nf_conntrack_helper.c","net/netfilter/nf_nat_core.c","net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbfde85308b99938a6092c48753214d190ece48d","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"},{"lessThan":"29d8cc44bbdf7b83a1929912214afe6643c1b4f1","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"},{"lessThan":"f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"},{"lessThan":"9d017671dcfcec23321fb7962dea624f9e71ddb1","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"},{"lessThan":"bf8c0b5dd203be94c2ad50e264cec19267c6bd39","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"},{"lessThan":"c3009418f9fa1dcb3eb86f4d8c92583537b5faa3","status":"affected","version":"f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_helper.h","net/ipv4/netfilter/nf_nat_h323.c","net/netfilter/nf_conntrack_helper.c","net/netfilter/nf_nat_core.c","net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.20"},{"lessThan":"2.6.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.94","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.36","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.176","versionStartIncluding":"2.6.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.143","versionStartIncluding":"2.6.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.94","versionStartIncluding":"2.6.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.36","versionStartIncluding":"2.6.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.13","versionStartIncluding":"2.6.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"2.6.20","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp->expectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp->expectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n  init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n  nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n  ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n  nf_hook_slow (net/netfilter/core.c:619)\n  __ip_local_out (net/ipv4/ip_output.c:120)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n  tcp_connect (net/ipv4/tcp_output.c:4374)\n  tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n  __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose ->expectfn matches the descriptor being torn\ndown. Call it from each NAT helper's exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops."}],"providerMetadata":{"dateUpdated":"2026-07-01T13:32:27.412Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d"},{"url":"https://git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1"},{"url":"https://git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d"},{"url":"https://git.kernel.org/stable/c/9d017671dcfcec23321fb7962dea624f9e71ddb1"},{"url":"https://git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39"},{"url":"https://git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3"}],"title":"netfilter: nf_conntrack: destroy stale expectfn expectations on unregister","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-53349","datePublished":"2026-07-01T13:32:27.412Z","dateReserved":"2026-06-09T07:44:35.399Z","dateUpdated":"2026-07-01T13:32:27.412Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-01 14:16:43","lastModifiedDate":"2026-07-01 14:16:43","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"53349","Ordinal":"1","Title":"netfilter: nf_conntrack: destroy stale expectfn expectations on ","CVE":"CVE-2026-53349","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"53349","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp->expectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp->expectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n  init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n  nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n  ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n  nf_hook_slow (net/netfilter/core.c:619)\n  __ip_local_out (net/ipv4/ip_output.c:120)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n  tcp_connect (net/ipv4/tcp_output.c:4374)\n  tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n  __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose ->expectfn matches the descriptor being torn\ndown. Call it from each NAT helper's exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.","Type":"Description","Title":"netfilter: nf_conntrack: destroy stale expectfn expectations on "}]}}}