CVE-2026-80664

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_nat: reject unsupported target families

xt_nat SNAT and DNAT target handlers assume IP-family conntrack state

is present and can dereference a NULL pointer when instantiated from an

unsupported family through nft_compat. A bridge-family compat rule can

therefore trigger a NULL-dereference in nf_nat_setup_info().

Reject non-IP families in xt_nat_checkentry() so unsupported targets

cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT

compat users and leave the runtime fast path unchanged.

[ The crash was fixed via

9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"),

so this patch is no longer critical.

Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra

family check is a good idea in any case. ]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References