{"id":"CVE-2026-98793","title":"netfilter: bpf: reject invalid NAT manipulation types","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_n…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058","Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < f6143ae109df56d51d5536e813deb19eee7a6205","Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < 58108f05b0502448f6bb612ee2eccc63bd6449cb","Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < 16d464013ec2267b00a83f4bfbb97b3ecc63bfa7","Linux 6.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:48:33.555Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98793","references":[{"url":"https://git.kernel.org/stable/c/ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058"},{"url":"https://git.kernel.org/stable/c/f6143ae109df56d51d5536e813deb19eee7a6205"},{"url":"https://git.kernel.org/stable/c/58108f05b0502448f6bb612ee2eccc63bd6449cb"},{"url":"https://git.kernel.org/stable/c/16d464013ec2267b00a83f4bfbb97b3ecc63bfa7"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.484Z","slug":"CVE-2026-98793","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_nat_setup_info(). This triggers\nthe WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set,\nthen IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack\ncleanup tries to unlink an uninitialized hlist node.\n\nFix this by checking that NAT manipulation type is correct before\ncalling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return\nNF_DROP instead of continuing with the processing to avoid similar\nsituations in the future.\n\n## Affected\n\n- `Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058`\n- `Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < f6143ae109df56d51d5536e813deb19eee7a6205`\n- `Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < 58108f05b0502448f6bb612ee2eccc63bd6449cb`\n- `Linux >= 0fabd2aa199faeb8754aee94658f2c48ccb2c8c3 < 16d464013ec2267b00a83f4bfbb97b3ecc63bfa7`\n- `Linux 6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}