Cloudanix VulnDB

CVE-2026-98322

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can leave part of a network address uninitialised during IPv4 translation, which may cause crashes or leak internal data.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialised upper bytes of the nf_inet_addr union are copied from an on-stack IPv4 netmap setup into nf_nat range structures, causing nf_nat_setup_info() to consume uninitialised kernel memory when nft_nat_eval() processes IPv4 mappings.

Why it matters to the business

Linux systems performing IPv4 NAT via nftables may experience kernel instability, information disclosure through uninitialised memory, or unpredictable network translation behaviour, raising operational risk for any environment relying on recent netfilter features.

How an attack unfolds

An attacker triggers nft_nat netmap processing for IPv4 traffic; the kernel builds a partially-initialised address structure that is later read by nf_nat_setup_info(), potentially leaking stack contents or causing undefined behaviour in the NAT path.

How to fix it

Apply the upstream kernel commit that zero-initialises new_addr in nft_nat_setup_netmap() before copying to the NAT range; rebuild and deploy updated kernels to all affected Linux distributions.

How to confirm the fix worked

Recompile with KMSAN enabled and confirm the uninit-value warning in nf_nat_setup_info() is eliminated; verify the fix appears in the running kernel source or changelog.

Typical attack path

  1. Send IPv4 packets that match an nftables NAT rule using the netmap target
  2. nft_nat_setup_netmap() writes only the 4-byte IPv4 address and leaves the remaining 12 bytes uninitialised
  3. The full 16-byte union is copied into the NAT range structures
  4. nf_nat_setup_info() reads the uninitialised bytes, triggering KMSAN or memory-safety faults

How to detect it

Review kernel logs for KMSAN reports referencing nf_nat_setup_info() or nft_nat_eval(); inspect system crashes or panics involving netfilter NAT during IPv4 traffic processing.

What your security team should do

  • Immediately schedule kernel updates for all systems using nftables IPv4 NAT
  • Monitor distribution security feeds for backported fixes
  • Temporarily restrict nft netmap usage on IPv4 if patches cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.

Affected packages

Ecosystem Package Introduced Fixed