CVE-2026-98793
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
netfilter: bpf: rechazar tipos de manipulación NAT no válidos
Como bpf_ct_set_nat_info() no valida el tipo de manipulación NAT, se puede pasar directamente a nf_nat_setup_info() un valor incorrecto. Esto activa el WARN_ON() en nf_nat_setup_info() y, si panic_on_warn no está establecido, entonces se establece IPS_SRC_NAT_DONE sin añadir nat_bysource, y la limpieza de conntrack intenta desvincular un nodo hlist no inicializado.
Para solucionarlo, se comprueba que el tipo de manipulación NAT es correcto antes de llamar a nf_nat_setup_info(). Además, si se activa el WARN_ON(), se devuelve NF_DROP en lugar de continuar con el procesamiento, para evitar situaciones similares en el futuro.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98793",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0fabd2aa199faeb8754aee94658f2c48ccb2c8c3",
"lessThan": "ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058",
"versionType": "git"
},
{
"status": "affected",
"version": "0fabd2aa199faeb8754aee94658f2c48ccb2c8c3",
"lessThan": "f6143ae109df56d51d5536e813deb19eee7a6205",
"versionType": "git"
},
{
"status": "affected",
"version": "0fabd2aa199faeb8754aee94658f2c48ccb2c8c3",
"lessThan": "58108f05b0502448f6bb612ee2eccc63bd6449cb",
"versionType": "git"
},
{
"status": "affected",
"version": "0fabd2aa199faeb8754aee94658f2c48ccb2c8c3",
"lessThan": "16d464013ec2267b00a83f4bfbb97b3ecc63bfa7",
"versionType": "git"
}
],
"programFiles": [
"net/netfilter/nf_nat_bpf.c",
"net/netfilter/nf_nat_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/nf_nat_bpf.c",
"net/netfilter/nf_nat_core.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:33.287",
"references": [
{
"url": "https://git.kernel.org/stable/c/16d464013ec2267b00a83f4bfbb97b3ecc63bfa7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/58108f05b0502448f6bb612ee2eccc63bd6449cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ea777dc90ab37e64fa4b92f6fcf3b5edcef5e058",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f6143ae109df56d51d5536e813deb19eee7a6205",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_nat_setup_info(). This triggers\nthe WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn't set,\nthen IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack\ncleanup tries to unlink an uninitialized hlist node.\n\nFix this by checking that NAT manipulation type is correct before\ncalling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return\nNF_DROP instead of continuing with the processing to avoid similar\nsituations in the future."
}
],
"lastModified": "2026-10-19T10:19:43.330",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}