CVE-2026-53349

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

NAT helpers such as nf_nat_h323 store a raw pointer to module text in

exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()

only unlinks the callback descriptor and never walks the expectation table,

so an expectation pending at module removal survives with a dangling

exp->expectfn into freed module text.

When the expected connection arrives, init_conntrack() invokes

exp->expectfn(), now a stale pointer into the unloaded module. Reproduced

on a KASAN build by loading the H.323 helpers, creating a Q.931

expectation, unloading nf_nat_h323, then connecting to the expected port:

Oops: int3: 0000 [#1] SMP KASAN NOPTI

RIP: 0010:0xffffffffa06102d1

init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)

nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)

ipv4_conntrack_local (net/netfilter/nf_conntrack_proto

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References