CVE-2026-80664

The Linux kernel's netfilter xt_nat module contains a flaw in which the SNAT and DNAT target handlers assume IP-family connection-tracking state is present and can dereference a NULL pointer when the target is instantiated from an unsupported family through nft_compat. A local actor able to manage netfilter rules (e.g., a process or container granted network-administration privileges) can install a bridge-family compat rule using the NAT target, triggering a NULL dereference in nf_nat_setup_info() and crashing the kernel, yielding denial of service; the CVSS score additionally weights high integrity impact. Only Linux systems where nft_compat and xt_nat are active and such bridge-family (or other non-IP-family) rules can be installed are realistically exposed — an uncommon configuration, even though the code ships in most distribution kernels. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known (EPSS: 0.1% in 30 days); the crash was also addressed upstream via nft_compat commit 9dbba7e694ec ("ebtables emulation must reject non-bridge targets"), and the xt_nat fix now rejects non-IP families while keeping NFPROTO_INET allowed.

What to do: Obtain a kernel update from your distribution that carries the upstream xt_nat non-IP-family rejection (and nft_compat fix 9dbba7e694ec); since no fixed version numbers are published in this advisory, follow your vendor's kernel advisory. As an interim mitigation, audit nftables/ebtables-emulation rules for SNAT/DNAT targets instantiated in bridge-family tables and keep NAT targets restricted to the ip, ip6, or inet families.