CVE-2026-53002
published 2026-06-24CVE-2026-53002: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.36%
28.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough
to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270
Write of size 1 at addr [..]
vsnprintf+0xea5/0x1270
sprintf+0xb1/0xe0
mangle_content_len+0x1ac/0x280
nf_nat_sdp_session+0x1cc/0x240
process_sdp+0x8f8/0xb80
process_invite_request+0x108/0x2b0
process_sip_msg+0x5da/0xf50
sip_help_tcp+0x45e/0x780
nf_confirm+0x34d/0x990
[..]
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < 2f793ba78470a99f40389b7dc60a81d9f5ad3956 | 2f793ba78470a99f40389b7dc60a81d9f5ad3956 |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < 6bbf829b4c1b44c941c47dd0d710f1393258f3d5 | 6bbf829b4c1b44c941c47dd0d710f1393258f3d5 |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < ab64e61c9323fa6de21bd20da1ddb29a0fb65d34 | ab64e61c9323fa6de21bd20da1ddb29a0fb65d34 |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < 1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e | 1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < a8e0a32a23d3f34862af3b4da792ecb3a891a9a3 | a8e0a32a23d3f34862af3b4da792ecb3a891a9a3 |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < 8e3be0d12615a173fe260cd42753ca7a001acbf2 | 8e3be0d12615a173fe260cd42753ca7a001acbf2 |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < c08ff52e44945e6ef4ce0790f49ea761b060c45b | c08ff52e44945e6ef4ce0790f49ea761b060c45b |
| linux | linux | >= 9fafcd7b203229c3f3893a475741afc27e276306 < 6e7066bdb481a87fe88c4fa563e348c03b2d373d | 6e7066bdb481a87fe88c4fa563e348c03b2d373d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.20 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.2 < 6.6.141 | 6.6.141 |
| linux | linux_kernel | >= 6.7 < 6.12.91 | 6.12.91 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 netfilter mangle_content_len out-of-bounds (WID-SEC-2026-2077)
vuldb·2026-06-26
CVE-2026-53002 [LOW] Linux Kernel up to 7.0.9 netfilter mangle_content_len out-of-bounds (WID-SEC-2026-2077)
A vulnerability has been found in Linux Kernel up to 7.0.9 and classified as critical. The impacted element is the function mangle_content_len of the component netfilter. This manipulation causes out-of-bounds read.
The identification of this vulnerability is CVE-2026-53002. The attack needs to be done within the local network. There is no exploit available.
The affected component should be upgraded.
GHSA
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the
ghsa_unreviewed·2026-06-24
CVE-2026-53002 In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough
to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270
Write of size 1 at addr [..]
vsnprintf+0xea5/0x1270
sprintf+0xb1/0xe0
mangle_content_len+0x1ac/0x280
nf_nat_sdp_session+0x1cc/0x240
process_sdp+0x8f8/0xb80
process_invite_request+0x108/0x2b0
process_sip_msg+0x5da/0xf50
sip_help_tcp+0x45e/0x780
nf_confirm+0x34d/0x990
[..]
Red Hat
kernel: netfilter: conntrack: remove sprintf usage
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-53002 [HIGH] CWE-787 kernel: netfilter: conntrack: remove sprintf usage
kernel: netfilter: conntrack: remove sprintf usage
A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of `sprintf` and insufficient buffer sizing in the `mangle_content_len()` function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue to cause a denial of service or other unspecified impacts.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterp
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1ehttps://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373dhttps://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45bhttps://access.redhat.com/security/cve/CVE-2026-53002https://bugzilla.redhat.com/show_bug.cgi?id=2492329https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json
2026-06-24
Published