CVE-2026-53349

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text.

When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port:

Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]

Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless.

Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Unchanged since Jul 2, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Record: CVE-2026-53349
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

CVE List No score

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Record: CVE-2026-53349
Updated: 2026-11-06

EUVDEUVD-2026-40983 No score

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Record: EUVD-2026-40983
Updated: 2026-11-06

GitHub AdvisoriesGHSA-qf7g-7vpq-493r 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack:...

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Record: GHSA-qf7g-7vpq-493r
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-53349 5.5

Record: BELL-CVE-2026-53349
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-53349 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops.

Record: DEBIAN-CVE-2026-53349
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-07

Show 28 moreShow less

OSVOESA-2026-3204 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()

Simplify the code by using device managed memory allocations.

This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.

Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").(CVE-2025-71273)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.

Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.(CVE-2026-31663)

In the Linux kernel, the following vulnerability has been resolved:

x86: shadow stacks: proper error handling for mmap lock

김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it.

So let's fix both issues.(CVE-2026-43109)

In the Linux kernel, the following vulnerability has been resolved:

srcu: Use irq_work to start GP in tiny SRCU

Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.

This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to:

call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock

workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock

Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins.

Tested with rcutorture SRCU-T and no lockdep warnings.

Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()"

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix 22000 series SMEM parsing

If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.(CVE-2026-43172)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix type confusion in bond_setup_by_slave()

kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg…

Record: OESA-2026-3204
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4591 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.(CVE-2025-40233)

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: properly keep track of conduit reference

Problem description

DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense.

There are two distinct problems.

The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch:

(unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind

we see these lines in the output diff which appear only with the patch applied:

kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)

After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()).

Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it.

So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference.

Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see…

Record: OESA-2026-4591
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-53349 5.5

Record: UBUNTU-CVE-2026-53349
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-10

OSVCLSA-2026-1789898700 No score

kernel: Fix of 163 CVEs

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
xfs: close crash window in attr dabtree…

Record: CLSA-2026-1789898700
Updated: 2026-11-02

OSV No score

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Record: CVE-2026-53349
Updated: 2026-11-07

OSVMGASA-2026-0312 No score

Updated kernel, kmod, bluez, firmware, wireless-regdb and drakx-installer-images packages fix security vulnerabilities

Upstream kernel version 6.18.39 fixes bugs and vulnerabilities. The kmod, bluez, wireless-regdb, firmware and drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0312
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2026-53349 No score

CVE-2026-53349 in linux - Patched by Root

Root has patched CVE-2026-53349 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-53349
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-53349 No score

CVE-2026-53349 in linux - Patched by Root

Root has patched CVE-2026-53349 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-53349
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-53349 No score

CVE-2026-53349 in linux - Patched by Root

Root has patched CVE-2026-53349 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-53349
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-53349 No score

CVE-2026-53349 in linux - Patched by Root

Root has patched CVE-2026-53349 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-53349
Updated: 2026-11-06

OSVUSN-8726-1 No score

linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)