CVE-2026-98321

What it actually does

Failure to unregister and release NAT hooks when nf_hook_entries_insert_raw() fails, resulting in a memory leak in the netfilter nf_nat subsystem.

Why it matters to the business

Gradual memory exhaustion on network address translation systems can degrade performance or trigger crashes, increasing operational overhead for Linux-based network infrastructure.

How an attack unfolds

An attacker or faulty configuration triggers error conditions during hook insertion in nf_nat, leaving allocated hooks unreleased and accumulating leaks over repeated attempts.

How to fix it

Apply the Linux kernel patch that postpones setting nat_proto_net->nat_hook_ops until after successful registration to ensure proper cleanup on error.

How to confirm the fix worked

Inspect kernel source for the updated error handling in nf_nat hook registration and verify no leaks occur under simulated insertion failures.

Typical attack path

1. Trigger nf_hook_entries_insert_raw failure paths in netfilter NAT registration
2. Repeat conditions that exercise partial hook setup
3. Observe cumulative memory growth without corresponding release

How to detect it

Check kernel logs and memory statistics for netfilter hook allocation patterns that do not match expected releases; correlate with NAT configuration changes.

What your security team should do

• Prioritize kernel updates containing the nf_nat error path fix
• Monitor memory usage on systems performing NAT
• Review netfilter configurations to reduce exposure to hook registration errors