CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup
An attacker with low privileges can trigger uninitialized memory disclosure in the Linux kernel netfilter NAT module, potentially leaking sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98322?
CVE-2026-98322 is a vulnerability in Linux, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_nat: fully initialise new_addr in netmap setup
nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised.
KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.
Zero-initialise new_addr.
Which versions are affected by CVE-2026-98322?
How do I fix CVE-2026-98322?
Apply the vendor's patch.
Is CVE-2026-98322 being exploited?
There is no known exploitation of CVE-2026-98322 in the wild and no public exploit code.
Sources
Also known as AZL-106158, BELL-CVE-2026-98322, DEBIAN-CVE-2026-98322, GHSA-3mpf-hfgc-g8p2, UBUNTU-CVE-2026-98322.