Live › vulnerability › CVE-2026-98793
Go to dashboardThe Linux kernel's netfilter BPF helper bpf_ct_set_nat_info() did not validate the NAT manipulation type before calling nf_nat_setup_info(). A wrong value triggers a kernel warning and can leave a conntrack entry in an inconsistent state that later causes a crash during cleanup.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with netfilter connection tracking and NAT that also load BPF programs calling the bpf_ct_set_nat_info() helper. Hosts without BPF netfilter programs, or with panic_on_warn enabled, are affected differently; the sources do not say which kernel versions are vulnerable.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: reject invalid NAT manipulation types
As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node.
Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.
This page as .md · .json · in your agent: get_signal("CVE-2026-98793")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.