CVE-2026-53002 netfilter: conntrack: remove sprintf usage
A stack buffer overflow in the Linux kernel's netfilter conntrack module allows attackers to cause a denial of service or potentially execute code via crafted SIP messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53002?
CVE-2026-53002 is a critical memory corruption vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]
Weakness: CWE-787
Which versions are affected by CVE-2026-53002?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Linux.
How do I fix CVE-2026-53002?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53002 being exploited?
There is no known exploitation of CVE-2026-53002 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53002, DEBIAN-CVE-2026-53002, GHSA-2256-5c36-mwcj, ROOT-OS-DEBIAN-11-CVE-2026-53002, ROOT-OS-DEBIAN-12-CVE-2026-53002, ROOT-OS-UBUNTU-2204-CVE-2026-53002 and 2 more.