CVE-2026-53267

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: bail out on template ct in get eval

I noticed this issue while looking at a historic syzbot report [1].

A rule like the one below is enough to trigger the bug:

table ip t {

chain pre {

type filter hook prerouting priority raw;

ct zone set 1

ct original saddr 1.2.3.4 accept

}

}

The first expression attaches a per-cpu template ct via

nft_ct_set_zone_eval() (nf_ct_tmpl_alloc -> kzalloc, tuple is all

zero, nf_ct_l3num(ct) == 0). The next expression then calls

nft_ct_get_eval() on the same skb, treats the template as a real ct

and hits the 16-byte memcpy path. With dreg at NFT_REG32_15 this

overflows past struct nft_regs on the kernel stack; with smaller

dreg values it silently clobbers adjacent registers.

Reject template ct at the eval entry and in nft_ct_get_fast_eval(),

mirroring the check nft_ct_set_eval() already has. Additionally,

bou

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References