Executive brief
The Linux kernel's netfilter NAT module (xt_nat) can be crashed when certain invalid packet filtering rules are installed via a compatibility layer. An attacker with privileges to add firewall rules can trigger a system crash by instantiating unsupported address family rules, causing a denial of service on systems using netfilter-based firewalls or container networks.
Technical details
A NULL pointer dereference vulnerability exists in the netfilter xt_nat SNAT and DNAT target handlers when processing unsupported protocol families through the nft_compat interface. The vulnerable code path allows bridge-family compatibility rules to reach nf_nat_setup_info() without validation, causing a kernel crash. The fix adds protocol family validation in xt_nat_checkentry() to reject non-IP families (only allowing NFPROTO_IPV4, NFPROTO_IPV6, and NFPROTO_INET). Exploitation requires local or admin-level access to install iptables/nftables rules. A prior commit (9dbba7e694ec) partially addressed this in nft_compat, but this patch adds defense-in-depth validation at the NAT module level.
Affected products
- Linux Linux kernel multiple versions through 6.19+ (patched in commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd)
Timeline
- 2026-08-28: disclosed
- 2026-06-13: patched: Fix committed upstream as 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd