CVE-2026-98321 netfilter: nf_nat: unregister and release hooks on error
A memory leak in the Linux kernel netfilter NAT module allows attackers to cause denial of service by triggering hook registration failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98321?
CVE-2026-98321 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat: unregister and release hooks on error
If nf_hook_entries_insert_raw() fails, the NAT hooks get never released, resulting in a memleak.
Postpone setting nat_proto_net->nat_hook_ops when the hooks are registered to simplify the error path to decide whether the nat hooks need unwinding.
Which versions are affected by CVE-2026-98321?
How do I fix CVE-2026-98321?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98321 being exploited?
There is no known exploitation of CVE-2026-98321 in the wild and no public exploit code.
Sources
Also known as AZL-106365, BELL-CVE-2026-98321, DEBIAN-CVE-2026-98321, GHSA-4xqv-x9wj-55p5, UBUNTU-CVE-2026-98321.