Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could allow a local user to crash the system or potentially gain unauthorized privileges. The issue occurs when specific firewall rules are processed, leading to memory corruption on the kernel stack. This could impact the stability and security of servers and workstations running affected versions of Linux.
Technical details
A stack-based buffer overflow exists in net/netfilter/nft_ct.c and net/netfilter/nft_ct_fast.c within the Linux kernel. The vulnerability is triggered when nft_ct_get_eval() incorrectly treats a connection tracking (ct) template as a real conntrack object. When a rule first attaches a template via nft_ct_set_zone_eval() and a subsequent expression calls nft_ct_get_eval() on the same socket buffer (skb), the kernel performs a 16-byte memcpy into a destination register. If the destination register (dreg) is near the end of the nft_regs structure, this operation overflows the kernel stack. An attacker with the ability to manage nftables rules could exploit this to clobber adjacent memory or cause a kernel panic. The fix involves rejecting template objects during evaluation and bounding the copy length by the validated register length.
Affected products
- Linux Linux Kernel 4.1 to 6.9.x
Timeline
- 2026-05-28: other: Patch authored
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2e154b5f53f1b0b490c7b8b02499f90feb86b1d5
- https://git.kernel.org/stable/c/3027ecbdb5fdf9200251c21d4818e4c447ef78e1
- https://git.kernel.org/stable/c/8470f676eadeab99132708acb1a85915664d6115
- https://git.kernel.org/stable/c/af80f78ce984649e1698b841cd33f4fa505ad828
- https://git.kernel.org/stable/c/f071b0bf078146368d18e4eec386bf2ddc0ab7e0