CVE-2026-98793

Received Received - Intake

BPF NAT Manipulation Type Validation Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node. Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98793

EUVD

EUVD-2026-103878

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0fabd2aa199faeb8754aee94658f2c48ccb2c8c3
Linux	Linux	0fabd2aa199faeb8754aee94658f2c48ccb2c8c3
Linux	Linux	0fabd2aa199faeb8754aee94658f2c48ccb2c8c3
Linux	Linux	0fabd2aa199faeb8754aee94658f2c48ccb2c8c3
Linux	Linux	6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of NAT manipulation types in the BPF subsystem. The function bpf_ct_set_nat_info() fails to check if the NAT type is valid before passing it to nf_nat_setup_info(). This can trigger a kernel warning and lead to incorrect connection tracking state, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter subsystem and requires kernel-level inspection. Detection involves checking kernel logs for WARN_ON triggers or unusual NAT-related errors. Use commands like 'dmesg | grep -i nat' or 'journalctl -k | grep -i nat' to search for related warnings. If you suspect exploitation, monitor for unexpected connection drops or corrupted NAT state in conntrack entries using 'conntrack -L'.

Impact Analysis

If exploited, this flaw could allow an attacker to cause a kernel warning or panic, leading to system instability or denial of service. It may also corrupt connection tracking data, affecting network operations and security monitoring.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel networking issue involving NAT manipulation. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the netfilter BPF NAT manipulation vulnerability. Monitor kernel logs for WARN_ON triggers in nf_nat_setup_info() as an indicator of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-98793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70