CVE-2026-98793
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node. Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.
Affected versions
Linux kernel versions
6.1
and later are affected. Fixed in
6.12.113,
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98793?
CVE-2026-98793 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.1 onward and has been patched in 6.12.113, 6.18.56, 7.2.10 and others. CVE-2026-98793 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98793?
Yes. CVE-2026-98793 has been patched. Fixed versions include 6.12.113, 6.18.56, 7.2.10 and others. If you are running Linux kernel 6.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98793 actively exploited?
No. CVE-2026-98793 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.