CVE-2026-98322

A flaw was found in the Linux kernel's Netfilter network filtering subsystem. When configuring IPv4 Network Address Translation (NAT) rules with the netmap feature, the system fails to initialize a temporary memory buffer on the stack. As a result, uninitialized kernel stack data is copied and processed during packet evaluation. A local user with network administration privileges can exploit this flaw to cause unexpected system behavior, leading to a Denial of Service (DoS) or the potential disclosure of sensitive kernel memory.

A flaw rated Moderate impact affects the Linux kernel's netfilter nftables NAT implementation in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases built on RHEL CoreOS 9. When an IPv4 NAT rule using the nftables netmap feature is configured, nft_nat_setup_netmap() writes only the 4-byte IPv4 member of the 16-byte on-stack union nf_inet_addr before copying the whole union into the NAT range, so up to 12 bytes of uninitialized kernel stack data reach nf_nat_setup_info() and are processed during packet evaluation. A local user with the network administration privileges (CAP_NET_ADMIN) needed to configure nftables rules could exploit this flaw to cause a denial of service, and the processed uninitialized stack data could potentially expose limited kernel memory, although no information disclosure has been demonstrated. The IPv6 netmap path initializes all 16 bytes of the union and is not affected. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform releases built on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those releases. For the affected products, the fix is currently deferred: given the moderate impact of the flaw and the requirement for local administrative privileges to trigger it, a fix is not planned for these releases at this time. The residual risk is that systems using IPv4 netmap NAT rules may experience a denial of service or, at most, limited exposure of uninitialized kernel stack data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw is only reachable through nftables IPv4 NAT rules that use the netmap feature. Avoiding the netmap option when configuring IPv4 NAT rules, and using explicit address ranges for the required translations instead, avoids the affected code path. For deployments where this is not practical, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.