Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-28T08:16:51.620Z",
  "pubdate": "2026-08-28T08:16:51.620Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists within the Linux kernel's netfilter xt_nat subsystem.\nThe flaw originates from the improper validation of address families when using nft_compat to instantiate SNAT or DNAT targets.\nBy bypassing family restrictions, specifically using non-IP families like bridge-family within an nft_compat rule, an attacker can trigger a kernel panic.\nSuccessful exploitation leads to a system-wide denial-of-service (DoS) via kernel crash.\nThe vulnerability affects kernel configurations that allow the interaction between nft_compat and xt_nat targets for unsupported address families.\nWhile subsequent patches (9dbba7e694ec) addressed the primary entry point, the current mitigation enforces stricter family checking to prevent underlying logic errors in the NAT subsystem.",
  "technicalDetails": "The root cause of this vulnerability lies in the assumption by xt_nat SNAT and DNAT target handlers that a valid IP-family conntrack state is always present during execution.\nIn the Linux kernel's netfilter architecture, the nft_compat module allows the use of legacy iptables/xtables targets within nftables rulesets. When a user defines a NAT target via nft_compat using an unsupported address family—specifically the bridge family—the kernel fails to validate the protocol family compatibility before instantiation.\nThe vulnerability is triggered during the execution of nf_nat_setup_info(). Because the NAT targets expect IP-based context, the lack of an IP-family conntrack state results in a NULL pointer being dereferenced when the kernel attempts to access structure members associated with the expected protocol family.\nAn attacker with sufficient privileges to configure nftables rulesets can inject a crafted rule that utilizes an incompatible family for SNAT or DNAT targets. When traffic subsequently traverses this hook, the system attempts to process the NAT setup with invalid parameters, leading to an immediate kernel-level NULL dereference and resulting in an oops or panic.\nThe impact is a deterministic denial-of-service condition affecting the host machine's kernel stability. Because the NAT targets are inherently designed only for IPv4 and IPv6 protocols, the absence of an explicit restriction in xt_nat_checkentry() allowed illegal state transitions that the runtime fast path was never designed to handle safely.\nWhile commit 9dbba7e694ec introduced a safeguard in nft_compat to reject non-bridge targets for ebtables emulation, the vulnerability highlights a lack of defensive programming in the xt_nat module itself. The recommended fix involves modifying xt_nat_checkentry() to explicitly reject non-IP families (allowing only NFPROTO_INET and expected IP families) at the registration phase, thereby preventing the target from being successfully installed in an invalid context."
}