In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info()… (CVE-2026-98793)

The Linux kernel vulnerability (CVE-2026-98793) involves improper validation in the netfilter BPF component. Specifically, bpf_ct_set_nat_info() failed to verify the NAT manipulation type before passing it to nf_nat_setup_info(), which could lead to a WARN_ON() condition. If panic_on_warn is not enabled, this results in setting IPS_SRC_NAT_DONE without properly adding nat_bysource, causing conntrack cleanup to attempt unlinking an uninitialized hlist node. The patch adds validation of the NAT manipulation type and changes the behavior to return NF_DROP if WARN_ON() is triggered, preventing further processing and similar issues.

This vulnerability could cause kernel warnings and potentially unstable connection tracking behavior due to improper cleanup of uninitialized data structures. While it does not explicitly state remote code execution or privilege escalation, the improper handling could lead to kernel instability or denial of service conditions under certain circumstances.

A fix has been implemented in the Linux kernel to validate NAT manipulation types before processing and to drop packets when invalid types are detected. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended mitigation.