« Volver al listado

CVE-2026-98322

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_nat: fully initialise new_addr in netmap setup

nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised.

KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.

Zero-initialise new_addr.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98322",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "29365695842db0a97b701a43a09fad1b4f7ecf3e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "7b9380c38c2fd2189416fa602bdbc5c8523b84b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "eb2030137dba3b59cbb5057a33af70488d6bc231",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "e4982c489ee359162eee3ece1fb36082648464a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "161f5860c92a8ec80b6bdff16e79d70dcd8afc5a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "0ce42c7b84032335abff9eac43762e4ca8224451",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "1c43f5db482f74b41987c39c9c375a5e767556eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
              "lessThan": "d313499df66159b4b7971d760d16729598ab7e5a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/netfilter/nft_nat.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/netfilter/nft_nat.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:24.243",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_nat: fully initialise new_addr in netmap setup\n\nnft_nat_setup_netmap() builds the mapped address in an on-stack\nunion nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip\nmember and the loop runs a single 32-bit iteration, but it then copies\nthe whole 16-byte union into range->min_addr and range->max_addr, so the\nupper 12 bytes reach nf_nat_setup_info() uninitialised.\n\nKMSAN reports an uninit-value in nf_nat_setup_info() reached from\nnft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.\n\nZero-initialise new_addr."
    }
  ],
  "lastModified": "2026-10-06T09:18:24.243",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}