HIGH Introduced in 3.7
netfilter xt_nat Deref
CVE-2026-80664
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
KernelScan AI5.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_NET_ADMIN (obtainable in a user namespace) can install a bridge-family NAT compat rule via nft_compat that triggers a NULL pointer dereference in the kernel, causing a system crash or denial of service. The vulnerability requires netfilter NAT support and the ability to configure nftables rules.
Vulnerability analysis
The kernel's NAT compatibility target assumes IP-family connection tracking state is always present. When an attacker installs a rule from an unsupported family such as bridge, that state is missing and the kernel dereferences a null pointer, causing a crash. The fix adds a family check during rule validation so that only IPv4, IPv6, and INET families are accepted, blocking unsupported targets from being installed. A local attacker with CAP_NET_ADMIN—which unprivileged users can acquire through a user namespace on most systems—can trigger this by installing a crafted compatibility rule.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.7 | 5.10.261 | 49abe5643914 |
| 5.15 | 3.7 | 5.15.212 | 0afc9ad987c0 |
| 6.1 | 3.7 | 6.1.178 | 4fbc2bac02ed |
| 6.6 | 3.7 | 6.6.145 | a842dab87cab |
| 6.18 | 3.7 | 6.18.40 | 679ced28a9dc |
| mainline | 3.7 | 7.2 | 5d1a2240935e |
| 6.12 | 3.7 | 6.12.97 | e35c048d7511 |
| 7.1 | 3.7 | 7.1.5 | ec88fa71c820 |
| cip/4.19 | 3.7 | 4.19.325-cip136 | 56572f2925f2 |
| cip/4.19-rt | 3.7 | 4.19.325-cip136-rt50 | 56572f2925f2 |
| cip/4.4 | 3.7 | 4.4.302-cip115 | 194e25e00a30 |
| cip/4.4-rt | 3.7 | 4.4.302-cip115-rt63 | 194e25e00a30 |
| cip/5.10 | 3.7 | 5.10.263-cip76 | 49abe5643914 |
| cip/5.10-rt | 3.7 | 5.10.268-cip77-rt34 | 49abe5643914 |
| cip/6.1 | 3.7 | 6.1.182-cip59 | 4fbc2bac02ed |
| cip/6.1-rt | 3.7 | 6.1.182-cip59-rt31 | 4fbc2bac02ed |
| cip/6.12 | 3.7 | 6.12.101-cip29 | e35c048d7511 |