Cloudanix VulnDB

CVE-2026-80664

High · 7.3

CVSS

7.3

EPSS

0.1%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's network translation code could let a logged-in user crash the system or potentially take control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in nf_nat_setup_info() triggered when xt_nat SNAT/DNAT targets are instantiated via nft_compat from a non-IP protocol family such as bridge.

Why it matters to the business

Local authenticated users can trigger kernel crashes or potential privilege escalation on Linux systems using netfilter NAT rules through compat interfaces, leading to denial of service or unauthorized access.

How an attack unfolds

An attacker with local access crafts an nft_compat rule using SNAT or DNAT targets in a bridge-family table; xt_nat_checkentry() accepts the rule without family validation, allowing nf_nat_setup_info() to dereference a NULL conntrack state pointer and crash or corrupt memory.

How to fix it

Apply the upstream fix that adds family validation in xt_nat_checkentry() to reject non-IP families while retaining NFPROTO_INET support; update to a kernel containing commit 9dbba7e694ec or later netfilter patches.

How to confirm the fix worked

Confirm the presence of the family check in xt_nat_checkentry() by inspecting kernel source or running a test that attempts to install an unsupported-family NAT target and verifies rejection.

Typical attack path

  1. Obtain local shell access on a Linux host with netfilter and nftables enabled
  2. Load or craft an ebtables/nft_compat rule that specifies an xt_nat target in a non-IP family
  3. Trigger rule installation or packet processing that reaches xt_nat_checkentry() and subsequently nf_nat_setup_info()
  4. Cause NULL dereference resulting in kernel panic or exploitable memory corruption

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing nf_nat_setup_info, xt_nat, or NULL dereference during nft_compat rule installation; review audit logs for unexpected bridge-family NAT target usage.

  • nf_nat_setup_info
  • xt_nat_checkentry
  • bridge-family compat NAT rule

What your security team should do

  • Prioritize kernel updates on all systems exposing netfilter NAT via nft_compat
  • Audit nftables/ebtables configurations for any bridge-family NAT rules
  • Monitor kernel logs for nf_nat_setup_info NULL dereference oops messages
  • Restrict unprivileged users from loading arbitrary nft_compat rules where possible

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]

Affected packages

Ecosystem Package Introduced Fixed