{"id":"CVE-2026-98793","kind":"vulnerability","aliases":["CVE-2026-98793"],"related":[],"title":"Linux kernel: invalid NAT type from BPF can corrupt connection tracking","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_nat_setup_info(). This triggers\nthe WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set,\nthen IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack\ncleanup tries to unlink an uninitialized hlist node.\n\nFix this by checking that NAT manipulation type is correct before\ncalling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return\nNF_DROP instead of continuing with the processing to avoid similar\nsituations in the future.","summary":"The Linux kernel's netfilter BPF helper bpf_ct_set_nat_info() did not validate the NAT manipulation type before calling nf_nat_setup_info(). A wrong value triggers a kernel warning and can leave a conntrack entry in an inconsistent state that later causes a crash during cleanup.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","netfilter"],"not_affected_if":["no-bpf-nat-programs"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the netfilter: bpf: reject invalid NAT manipulation types fix; the sources do not name the fixed version.","status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:13+00:00","updated_at":"2026-10-25T05:15:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:15:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the netfilter: bpf: reject invalid NAT manipulation types fix; the sources do not name the fixed version.","reach":"local","title":"Linux kernel: invalid NAT type from BPF can corrupt connection tracking","impact":"medium","summary":"The Linux kernel's netfilter BPF helper bpf_ct_set_nat_info() did not validate the NAT manipulation type before calling nf_nat_setup_info(). A wrong value triggers a kernel warning and can leave a conntrack entry in an inconsistent state that later causes a crash during cleanup.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","netfilter","bpf"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel warning, then conntrack corruption and a possible kernel crash","analyst_note":"Find the fixed kernel versions and the CVSS score in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98793) and the upstream kernel commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bpf-nat-programs"],"who_is_affected":"Systems running a Linux kernel with netfilter connection tracking and NAT that also load BPF programs calling the bpf_ct_set_nat_info() helper. Hosts without BPF netfilter programs, or with panic_on_warn enabled, are affected differently; the sources do not say which kernel versions are vulnerable.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000637,"input_tokens":3492,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98793':14A,17A 'add':141C 'addit':171C 'avoid':188C 'bpf':7A,18B,29B,31B,84C,91C 'bysourc':143C 'call':44B,165C 'caus':68B 'check':157C 'cleanup':72B,146C 'connect':10A 'conntrack':60B,145C 'continu':183C 'correct':163C 'corrupt':9A 'crash':70B 'ct':32B,92C 'cve':12A,15A 'direct':109C 'done':137C 'drop':180C 'entri':61B 'fix':154C 'follow':78C 'futur':193C 'helper':30B 'hit':177C 'hlist':152C 'inconsist':64B 'info':35B,48B,95C,114C,124C,169C 'infrastructur':19B 'instead':181C 'invalid':3A,86C 'ip':134C 'isn':130C 'kernel':2A,22B,26B,54B,76C 'later':67B 'leav':58B 'linux':1A,21B,25B,75C 'linux-kernel':20B 'manipul':41B,88C,101C,160C 'nat':4A,34B,40B,46B,87C,94C,100C,112C,122C,136C,142C,159C,167C 'netfilt':23B,28B,83C 'nf':45B,111C,121C,166C,179C 'node':153C 'panic':127C 'pass':108C 'process':186C 'reject':85C 'resolv':82C 'return':178C 'set':33B,93C,132C,139C 'setup':47B,113C,123C,168C 'similar':189C 'situat':190C 'src':135C 'state':65B 'track':11A 'tri':147C 'trigger':52B,116C 'type':5A,42B,89C,102C,161C 'uniniti':151C 'unlink':149C 'valid':38B,98C 'valu':51B,105C 'vulner':79C 'warn':55B,118C,129C,174C 'without':140C 'wrong':50B,104C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with netfilter connection tracking and NAT that also load BPF programs calling the bpf_ct_set_nat_info() helper. Hosts without BPF netfilter programs, or with panic_on_warn enabled, are affected differently; the sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98793","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-21T13:21:46+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}