CVE-2026-80664
Received Received - Intake

xt_nat Target Null Pointer Dereference in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-80664
EUVD
EUVD-2026-67540

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel netfilter *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's netfilter subsystem. It involves the xt_nat module, which handles network address translation (NAT) for SNAT and DNAT operations. The issue occurs when NAT rules are created for unsupported network families (like bridge) through nft_compat. This can lead to a NULL pointer dereference in nf_nat_setup_info(), causing a system crash.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's netfilter xt_nat module when handling unsupported target families. Detection requires checking kernel logs for crashes or errors related to nf_nat_setup_info or xt_nat_checkentry. Monitor system logs for kernel oops or segmentation faults.

Impact Analysis

If exploited, this vulnerability could cause a denial of service by crashing the system. It may allow attackers to trigger kernel panics, leading to service disruptions or unauthorized access attempts. Systems using NAT rules for non-IP families are at risk.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. The patch rejects non-IP families in xt_nat_checkentry, preventing the NULL dereference. Check your distribution's security advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart