CVE-2026-98322: Linux kernel · netfilter: nft_nat: fully initialise new_addr in netmap setup
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in eb2030137dba3b59cbb5057a33af70488d6bc231 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 12:55 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in eb2030137dba3b59cbb5057a33af70488d6bc231, e4982c489ee359162eee3ece1fb36082648464a5, d313499df66159b4b7971d760d16729598ab7e5a +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in multiple Linux kernel commits identified by their hashes. Users running Linux kernel version 5.8 should upgrade to a fixed version containing these commits to remediate the vulnerability. No additional mitigation steps are indicated.
Description
A vulnerability in the Linux kernel's netfilter nft_nat component involves uninitialized memory usage during IPv4 address mapping in netmap setup. Specifically, the new_addr union is not fully initialized, leading to uninitialized bytes being copied and potentially used. The issue affects version 5.8 of the Linux kernel and has been fixed by zero-initializing the new_addr structure.
References
- git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e (opens in a new tab)
- git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2 (opens in a new tab)
- git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231 (opens in a new tab)
- git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5 (opens in a new tab)
- git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a (opens in a new tab)
- git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451 (opens in a new tab)
- git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb (opens in a new tab)
- git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a (opens in a new tab)