CVE-2026-98322netfilter: nft_nat: fully initialise new_addr in netmap setup
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < 29365695842db0a97b701a43a09fad1b4f7ecf3e
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < 7b9380c38c2fd2189416fa602bdbc5c8523b84b2
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < eb2030137dba3b59cbb5057a33af70488d6bc231
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < e4982c489ee359162eee3ece1fb36082648464a5
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < 161f5860c92a8ec80b6bdff16e79d70dcd8afc5a
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < 0ce42c7b84032335abff9eac43762e4ca8224451
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < 1c43f5db482f74b41987c39c9c375a5e767556eb
- affected 3ff7ddb1353da9b535e65702704cbadea1da9a00 – < d313499df66159b4b7971d760d16729598ab7e5a
- affected 5.8
- unaffected < 5.8
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e (opens in a new tab)
- https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2 (opens in a new tab)
- https://git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231 (opens in a new tab)
- https://git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5 (opens in a new tab)
- https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a (opens in a new tab)
- https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451 (opens in a new tab)
- https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb (opens in a new tab)
- https://git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93307 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98322)Record last updated .