← Vulnerability feed

Vulnerability record · CVE-2026-53002 · published 24 June 2026

CVE-2026-53002: Linux kernel out-of-bounds write vulnerability

Linux · Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]

9.8 CVSS 3.1 Critical EPSS 0.53% · top 57.6% CWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
15References
10 Sep 2026Last modified by NVD

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e Patch
https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956 Patch
https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5 Patch
https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d Patch
https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2 Patch
https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3 Patch
https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34 Patch
https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b Patch
https://access.redhat.com/errata/RHSA-2026:64770
https://access.redhat.com/errata/RHSA-2026:66000
https://access.redhat.com/errata/RHSA-2026:66180
https://access.redhat.com/security/cve/CVE-2026-53002 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492329 Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json Third Party Advisory

Track CVE-2026-53002 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-39682Linux kernel TLS zero-length record handling flaw on rx_listThe Linux kernel TLS receive path mishandles zero-length records that arrive from the rx_list, breaking the assumption that a record type change cann…KEVEPSS 2.9%analysed9.8CVE-2019-11043PHP-FPM buffer overflow enables remote code executionPHP-FPM in certain configurations writes past allocated buffers into FCGI protocol data space, an out-of-bounds write (CWE-787, CWE-120). It affects …KEVEPSS 100%analysed9.8CVE-2018-14667RichFaces Framework EL injection enables unauthenticated remote code executionRichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language injection through the UserResource resource. A remote, unauthenticated att…KEVEPSS 74%analysed9.8CVE-2014-7169GNU Bash environment variable function parsing command injection (Shellshock variant)GNU Bash through 4.3 bash43-025 processes trailing strings after malformed function definitions in environment variable values, allowing command inje…KEVEPSS 100%analysed9.8CVE-2014-6271GNU Bash environment variable command injection (ShellShock)GNU Bash through 4.3 processes trailing strings after function definitions in environment variable values, allowing injected commands to run when Bas…KEVEPSS 100%analysed9.0CVE-2021-40438Apache HTTP Server mod_proxy SSRF via crafted URI pathA crafted request URI path can make mod_proxy forward the request to an origin server chosen by the remote user, an SSRF flaw in Apache HTTP Server 2…KEVEPSS 100%analysed8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2025-31277Apple WebKit memory corruption via malicious web contentApple WebKit fails to handle memory correctly when processing crafted web content, leading to memory corruption across Safari, iOS, iPadOS, macOS, tv…KEVEPSS 1.6%analysed

Source: NIST National Vulnerability Database (record CVE-2026-53002), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.