In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_nat: fully initialise new_addr in netmap setup

nft_nat_setup_netmap() builds the mapped address in an on-stack
union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip
member and the loop runs a single 32-bit iteration, but it then copies
the whole 16-byte union into range->min_addr and range->max_addr, so the
upper 12 bytes reach nf_nat_setup_info() uninitialised.

KMSAN reports an uninit-value in nf_nat_setup_info() reached from
nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.

Zero-initialise new_addr.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451 cve-icon cve-icon
https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a cve-icon cve-icon
https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb cve-icon cve-icon
https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e cve-icon cve-icon
https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2 cve-icon cve-icon
https://git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a cve-icon cve-icon
https://git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5 cve-icon cve-icon
https://git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231 cve-icon cve-icon
History

Tue, 06 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665
CWE-919

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.
Title netfilter: nft_nat: fully initialise new_addr in netmap setup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:46:16.346Z

Reserved: 2026-09-25T10:25:14.340Z

Link: CVE-2026-98322

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:24.243

Modified: 2026-10-06T09:18:24.243

Link: CVE-2026-98322

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T14:30:07Z

Weaknesses