CVE-2026-52970: Linux Kernel Netfilter Memory Leak Denial of Service

Technical summary

The nft_ct_expect_obj_eval() function in the netfilter nft_ct module allocates an expectation object via the kernel's connection tracking subsystem but fails to decrement the reference count before returning. While the function may successfully call nf_ct_expect_related() to register the expectation, the local reference held by the allocating function is never released. This creates a reference leak where allocated expectation structures remain in memory indefinitely. Over repeated invocations, this leads to kernel memory exhaustion and can trigger out-of-memory conditions, denial of service, or system instability. The fix is straightforward: adding an nf_ct_expect_put(exp) call before function return to properly balance the allocation.

Business impact

Organizations running affected Linux kernel versions face potential service availability risks. Persistent memory leaks in netfilter code can degrade firewall and NAT performance over time, eventually causing kernel panics or forced system reboots. In containerized or virtualized environments where multiple tenants share kernel resources, a malicious local user could accelerate the leak to disrupt other workloads. Production systems relying on netfilter for connection tracking, firewalling, or load balancing may experience unexpected downtime if the leak remains unpatched.

Affected systems

This vulnerability affects the Linux kernel across versions that include the vulnerable nft_ct netfilter module code path. The issue requires local code execution context to exploit, so exposure is limited to systems where unprivileged local users or untrusted applications can execute code. Embedded systems, servers with local user accounts, multi-tenant cloud instances, and containerized deployments running vulnerable kernel versions are at risk.

Exploitability

Exploitation requires local access and the ability to repeatedly trigger the nft_ct_expect_obj_eval() function. This is not a remote vulnerability. An attacker with a local user account or ability to run code on the target system could trigger the leak through normal or crafted firewall configuration operations that invoke the affected code path. The vulnerability is not weaponized by default—it requires intentional or repeated invocation to accumulate sufficient memory leaks for a visible denial-of-service effect, making casual exploitation unlikely but deliberate attacks feasible.

Remediation

Apply a kernel update that includes the fix to nft_ct_expect_obj_eval() adding the missing nf_ct_expect_put(exp) call. Organizations should verify the specific kernel version deployed and cross-reference vendor security advisories or kernel.org release notes for patched versions. For systems unable to immediately patch, restrict local user access and disable netfilter connection tracking features if not required. Consider isolating untrusted workloads or implementing local execution controls to reduce exposure.

Patch guidance

Consult your Linux distribution's security advisories for the patched kernel version applicable to your deployment. Canonical (Ubuntu), Red Hat, SUSE, Debian, and other distributions will publish kernel updates addressing this issue. Verify the patch includes the commit that adds nf_ct_expect_put(exp) to nft_ct_expect_obj_eval(). Test patches in a non-production environment before deployment, particularly for systems relying on netfilter for critical firewall or NAT functions. Kernel updates typically require a reboot to take effect.

Detection guidance

Monitor kernel logs for out-of-memory errors, excessive memory consumption by the nf_conntrack subsystem, or unexpected system slowdowns on production systems. Memory profiling tools like 'slabtop' can reveal whether nf_conntrack memory pools are growing abnormally. Repeated invocation of netfilter expect operations (via iptables, nftables, or conntrack tools) without corresponding cleanup may indicate the leak is being triggered. Implement kernel memory usage alerts and establish baselines for healthy netfilter memory consumption in your environment.

Why prioritize this

This vulnerability merits patching but is not critical. The CVSS 5.5 MEDIUM score reflects the local-only requirement combined with availability impact. However, the straightforward nature of the fix, absence from the CISA KEV catalog, and low exploitation complexity suggest this can be incorporated into regular maintenance windows rather than treated as an emergency. Prioritize patching for multi-user systems, shared hosting environments, and containers where local access is possible; for single-purpose servers with restricted local access, this can follow standard patch management cadence.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a medium-severity availability-focused vulnerability. Attack Vector Local and Privilege Level Low indicate that an unprivileged local user can trigger the issue. Attack Complexity Low means no special conditions are required beyond local code execution. The Availability Impact High captures the denial-of-service potential through resource exhaustion. Confidentiality and Integrity are not impacted. The score appropriately places this as a moderate concern requiring attention but not emergency remediation.

Frequently asked questions