# CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval

> A stack buffer overflow in the Linux kernel netfilter subsystem allows local attackers to execute arbitrary code or escalate privileges via crafted nftables rules.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jun 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-90947, BELL-CVE-2026-53267, DEBIAN-CVE-2026-53267, GHSA-mrf2-hc9c-229v, ROOT-OS-DEBIAN-11-CVE-2026-53267, ROOT-OS-DEBIAN-12-CVE-2026-53267, ROOT-OS-UBUNTU-2204-CVE-2026-53267, ROOT-OS-UBUNTU-2404-CVE-2026-53267, UBUNTU-CVE-2026-53267

## What is CVE-2026-53267?

CVE-2026-53267 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: bail out on template ct in get eval

I noticed this issue while looking at a historic syzbot report [1].

A rule like the one below is enough to trigger the bug:

    table ip t {
        chain pre {
            type filter hook prerouting priority raw;
            ct zone set 1
            ct original saddr 1.2.3.4 accept
        }
    }

The first expression attaches a per-cpu template ct via
nft_ct_set_zone_eval() (nf_ct_tmpl_alloc -> kzalloc, tuple is all
zero, nf_ct_l3num(ct) == 0). The next expression then calls
nft_ct_get_eval() on the same skb, treats the template as a real ct
and hits the 16-byte memcpy path. With dreg at NFT_REG32_15 this
overflows past struct nft_regs on the kernel stack; with smaller
dreg values it silently clobbers adjacent registers.

Reject template ct at the eval entry and in nft_ct_get_fast_eval(),
mirroring the check nft_ct_set_eval() already has. Additionally,
bound the address copy in NFT_CT_SRC / NFT_CT_DST by priv->len
instead of by nf_ct_l3num(ct): nf_ct_get_tuple() zeroes the tuple
before pkt_to_tuple() fills in only the protocol-relevant leading
bytes, so the trailing bytes of tuple->{src,dst}.u3.all are
well-defined zero. priv->len is validated at rule load, so the
copy size is now bounded by the destination register rather than
by an untrusted field on the conntrack.

[1]: https://syzkaller.appspot.com/bug?id=389cf09cb72926114fce90dc85a2c3231dcb647c

Weakness: CWE-674 (Uncontrolled Recursion), CWE-121 (Stack-based Buffer Overflow)

## Which versions are affected by CVE-2026-53267?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-53267?

Apply the vendor's patch.

## Is CVE-2026-53267 being exploited?

There is no known exploitation of CVE-2026-53267 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-53267 and fix it if it is affected.

What it is: CVE-2026-53267 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-53267 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-53267/ (Markdown: https://insights.sbomify.com/CVE-2026-53267/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-53267
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53267
- OSV: https://osv.dev/vulnerability/CVE-2026-53267

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-53267/
Summaries are generated and may contain mistakes; the official description above is the record.