CVE-2026-53267: Linux Kernel Netfilter nft_ct Stack Overflow Vulnerability

Technical summary

CVE-2026-53267 is a stack buffer overflow in the netfilter nft_ct subsystem affecting rule evaluation. The vulnerability stems from improper handling of per-CPU template connection tracking objects allocated via nft_ct_set_zone_eval(). When a template conntrack (with l3num==0) is passed to nft_ct_get_eval(), the code performs a 16-byte memcpy from the template's tuple address field without proper bounds checking. By placing the destination register (dreg) at NFT_REG32_15, an attacker can overflow past the nft_regs structure on the kernel stack. The fix involves: (1) adding explicit template conntrack rejection at eval entry and in nft_ct_get_fast_eval(), mirroring existing checks in nft_ct_set_eval(), and (2) bounding address copies by priv->len (validated at rule load time) rather than the untrusted nf_ct_l3num() field.

Business impact

Organizations running Linux systems with netfilter/nftables enabled face kernel crash and potential code execution risks. Systems used for firewalling, load balancing, or network policy enforcement are most exposed. The attack requires local system access and firewall rule creation capability, limiting exposure to containerized deployments, multi-tenant systems, and environments where unprivileged users can manage network policies. Denial of service via kernel panic is the primary concern; privilege escalation is theoretically possible depending on memory layout and exploitation sophistication.

Affected systems

All Linux kernel versions with the netfilter nft_ct module are affected. The vulnerability was identified through historical syzbot analysis and impacts any system running nftables for packet filtering or conntrack management. This includes standard Linux distributions with CONFIG_NF_TABLES enabled, containerized environments with network policy enforcement, and network appliances based on Linux kernels. Specific patched versions should be verified against vendor advisories.

Exploitability

The vulnerability requires local system access and the ability to load netfilter rules—typically available to unprivileged local users on systems where nftables is user-accessible or where containerized workloads can define network policies. The trigger is deterministic: a specific sequence of firewall rules reliably causes the overflow. No authentication bypass is needed. However, practical exploitation to achieve code execution requires knowledge of kernel memory layout and register state prediction, making widespread automated exploitation less likely than denial-of-service attacks via deliberate kernel panic.

Remediation

Apply the kernel patch that adds template conntrack validation in nft_ct_get_eval() and nft_ct_get_fast_eval(), and bounds the address copy operation by priv->len. Patch details should be verified against your Linux distribution's security advisory. Interim mitigations include restricting firewall rule management to trusted users via capability-based access controls (CAP_NET_ADMIN), disabling user-namespace nftables access if not required, and isolating unprivileged workloads in containers with restricted network policy namespaces.

Patch guidance

Monitor your Linux distribution's security updates for kernel patches addressing CVE-2026-53267. The fix targets the netfilter subsystem and may be available as a backport to stable kernel branches. Verify patch applicability against your kernel version and distribution. Test patches in staging environments before production rollout, particularly on systems heavily reliant on nftables for runtime policy management. Kernel version bumps may be required depending on your distribution's update cadence.

Detection guidance

Detection focuses on preventing malicious rule injection and monitoring for kernel crashes. Implement audit logging for netfilter rule loading (auditctl rules for nftables/iptables commands). Monitor system logs for kernel stack overflow panics or BUG messages originating from nf_ct code paths. In containerized environments, track pod-level network policy mutations and restrict nftables access to privileged containers. Behavioral detection via watchdog timers for unexpected kernel panics can alert to exploitation attempts, though distinguishing CVE-2026-53267 from other kernel bugs requires log analysis.

Why prioritize this

This vulnerability merits urgent patching despite its local-access requirement. Stack buffer overflows in kernel code are high-impact due to memory corruption potential. The deterministic trigger, combined with nftables' increasing adoption in container networking and cloud infrastructure, increases practical risk. Organizations with user-accessible nftables or unprivileged network policy management should prioritize patches. Systems where firewall rule creation is restricted to administrators can defer patching slightly in favor of access control hardening.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects high impact (confidentiality, integrity, and availability all rated 'high') with low attack complexity and low privilege requirement, offset by the local attack vector. This aligns with the vulnerability's kernel memory corruption capability and deterministic exploitability, though practical weaponization requires local access. The score appropriately reflects risk to privilege-separated systems; defense-in-depth via access controls can reduce realized risk below the base score.

Frequently asked questions