CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types
A missing validation in the Linux kernel netfilter BPF NAT handling allows a low-privileged user to trigger a kernel warning and potential crash, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98793?
CVE-2026-98793 is a denial of service vulnerability in Linux, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bpf: reject invalid NAT manipulation types
As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node.
Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.
Which versions are affected by CVE-2026-98793?
How do I fix CVE-2026-98793?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98793 being exploited?
There is no known exploitation of CVE-2026-98793 in the wild and no public exploit code.
Sources
Also known as AZL-109290, BELL-CVE-2026-98793, DEBIAN-CVE-2026-98793, GHSA-g33v-6845-q9px, UBUNTU-CVE-2026-98793.