CVE-2026-53000

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nat: use kfree_rcu to release ops<br /> <br /> Florian Westphal says:<br /> <br /> "Historically this is not an issue, even for normal base hooks: the data<br /> path doesn&amp;#39;t use the original nf_hook_ops that are used to register the<br /> callbacks.<br /> <br /> However, in v5.14 I added the ability to dump the active netfilter<br /> hooks from userspace.<br /> <br /> This code will peek back into the nf_hook_ops that are available<br /> at the tail of the pointer-array blob used by the datapath.<br /> <br /> The nat hooks are special, because they are called indirectly from<br /> the central nat dispatcher hook. They are currently invisible to<br /> the nfnl hook dump subsystem though.<br /> <br /> But once that changes the nat ops structures have to be deferred too."<br /> <br /> Update nf_nat_register_fn() to deal with partial exposition of the hooks<br /> from error path which can be also an issue for nfnetlink_hook.