CVE-2026-80664

A flaw was found in the Linux kernel's netfilter component, specifically within the xt_nat SNAT and DNAT target handlers. These handlers incorrectly assume the presence of an IP-family connection tracking state. A local attacker, by instantiating these handlers from an unsupported family, such as a bridge-family, through nft_compat, could trigger a NULL pointer dereference. This vulnerability could lead to a system crash, resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel's netfilter xt_nat component, affecting the kernel and kernel-rt packages as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10. The xt_nat SNAT and DNAT target handlers assume that IP-family connection tracking state is present; when such a target is instantiated from an unsupported family, such as a bridge-family rule installed through nft_compat, nf_nat_setup_info() may dereference a NULL pointer. A local attacker with the ability to install netfilter rules (for example via CAP_NET_ADMIN) could use this to crash the kernel, causing a denial of service; there is no supported path to information disclosure, privilege escalation or data modification. Red Hat Enterprise Linux 6 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. The fix for the affected RHEL streams is currently deferred: upstream indicates that the crash path was already addressed by a separate nft_compat change that rejects non-bridge targets in ebtables emulation, so the additional xt_nat family check is defensive hardening, and the residual risk on deferred streams is that a local privileged user could trigger a kernel panic. Red Hat rates this flaw MODERATE (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVEORG rating of 7.3 IMPORTANT, because exploitation requires local access with privileges to install netfilter rules and the impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.