CVE-2026-98793netfilter: bpf: reject invalid NAT manipulation types
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node. Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 before ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058; from 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 before f6143ae109df56d51d5536e813deb19eee7a6205; from 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 before 58108f05b0502448f6bb612ee2eccc63bd6449cb; from 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 before 16d464013ec2267b00a83f4bfbb97b3ecc63bfa7 | CNA record |
References
- https://git.kernel.org/stable/c/ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058
- https://git.kernel.org/stable/c/f6143ae109df56d51d5536e813deb19eee7a6205
- https://git.kernel.org/stable/c/58108f05b0502448f6bb612ee2eccc63bd6449cb
- https://git.kernel.org/stable/c/16d464013ec2267b00a83f4bfbb97b3ecc63bfa7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.