CVE-2026-98793 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: reject invalid NAT manipulation types
As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node.
Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel's netfilter subsystem contains a critical validation deficiency within its BPF (Berkeley Packet Filter) connection tracking interface that allows for improper handling of Network Address Translation operations. Specifically, the function bpf_ct_set_nat_info lacks adequate verification of the NAT manipulation type parameter before it is passed to nf_nat_setup_info. This absence of input sanitization means that a malicious or erroneous user-space BPF program can supply an invalid or unexpected value directly into the kernel's network translation logic without triggering any immediate rejection mechanisms designed to catch such anomalies during normal packet processing flows.
When this unchecked value reaches nf_nat_setup_info, it triggers a WARN_ON macro because the supplied manipulation type does not correspond to valid NAT configurations recognized by the subsystem. Under standard system configurations where panic_on_warn is disabled, the kernel continues execution despite detecting the invalid state. This continuation leads to a logical inconsistency in the connection tracking table management. The system sets the IPS_SRC_NAT_DONE flag on the conntrack entry but fails to properly initialize or link the associated nat_bysource data structures. Consequently, when the connection tracking subsystem attempts to perform cleanup operations and unlink nodes from its hash lists, it operates on uninitialized hlist nodes. This results in memory corruption, potential kernel panics, or undefined behavior that can destabilize the entire networking stack of the host system.
From a security perspective, this vulnerability represents a classic case of improper input validation leading to state inconsistency within critical infrastructure components. It aligns with CWE-20 Improper Input Validation as the root cause lies in the failure to verify that user-supplied data conforms to expected constraints before processing. Furthermore, because it involves manipulating network connection states and potentially causing denial-of-service conditions through kernel instability or crashes, it relates to CWE-400 Uncontrolled Resource Consumption if exploited for DoS purposes. In terms of adversary tactics, this flaw could be leveraged in the context of ATT&CK technique T1529 System Shutdown or Reboot via exploitation of system stability mechanisms, although its primary impact is often denial-of-service through kernel panic rather than intentional shutdown commands.
The operational impact of this vulnerability extends beyond simple application crashes. Since netfilter handles packet filtering and translation for virtually all network traffic on a Linux-based host, compromising the integrity of connection tracking can lead to widespread connectivity issues or complete loss of network functionality. An attacker with access to BPF capabilities, such as through containerized environments that allow privileged eBPF programs, could exploit this flaw to crash the kernel repeatedly, effectively achieving a denial-of-service attack against the host and potentially affecting other containers running on the same node due to shared kernel resources.
To mitigate this risk, it is essential to apply the upstream Linux kernel patches that enforce strict validation of NAT manipulation types within bpf_ct_set_nat_info. Administrators should ensure their systems are updated with versions containing these fixes. Additionally, organizations relying heavily on BPF for network security policies should review their eBPF program loading permissions and restrict access to privileged capabilities where possible. Monitoring system logs for WARN_ON messages related to nf_nat_setup_info can also serve as an early detection mechanism for attempted exploitation or misconfiguration before a full kernel panic occurs.