CVE-2026-53002: netfilter: conntrack: remove sprintf usage
In the Linux kernel, the following vulnerability has been resolved:
Other sources
netfilter: conntrack: remove sprintf usage
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Configuration
In netfilter conntrack code, remove sprintf usage and replace it with scnprintf (the buffer sizes are expected to be large enough to hold the result; no snprintf overflow check is needed).
Linux kernel netfilter conntrack sprintf usage in mangle_content_len()/related code path = Replace with scnprintf - Configuration
Increase the buffer size used in mangle_content_len() while removing sprintf usage to ensure sufficient space for the scnprintf output.
Linux kernel netfilter conntrack (mangle_content_len) Buffer size in mangle_content_len() = Increase
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53002?
CVE-2026-53002 has a severity rating of critical with a score of 9.8.
What impact does CVE-2026-53002 have on affected systems?
CVE-2026-53002 can lead to potential information leaks or system crashes due to improper buffer handling.
How can I mitigate CVE-2026-53002?
Mitigation for CVE-2026-53002 involves updating to the patched version of the Linux kernel that resolves this vulnerability.
Is CVE-2026-53002 a remote exploit?
Yes, CVE-2026-53002 can be exploited remotely as it involves the netfilter component of the kernel.
What versions of the Linux kernel are affected by CVE-2026-53002?
CVE-2026-53002 affects specific versions of the Linux kernel prior to the fix implemented in the referenced commits.