CVE-2026-80664: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80664 Overview

CVE-2026-80664 is a NULL pointer dereference vulnerability in the Linux kernel's netfilter subsystem, specifically in the xt_nat module. The xt_nat SNAT and DNAT target handlers assume that IP-family connection tracking (conntrack) state is present. When these targets are instantiated from an unsupported family through nft_compat, the handlers can dereference a NULL pointer. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The kernel maintainers resolved the issue by rejecting non-IP families in xt_nat_checkentry(), preventing installation of unsupported targets while preserving NFPROTO_INET for valid inet NAT compat users.

Critical Impact
A local user with the CAP_NET_ADMIN capability can trigger a kernel NULL-dereference, causing a denial-of-service crash of the affected host.

Affected Products

Linux kernel xt_nat netfilter module
Linux kernel nft_compat subsystem
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-08-28 - CVE-2026-80664 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80664

Vulnerability Analysis

The vulnerability resides in the xt_nat target handlers that implement SNAT (Source Network Address Translation) and DNAT (Destination Network Address Translation) functionality. These handlers were written under the assumption that they would only be invoked in IPv4 or IPv6 contexts where a valid conntrack entry exists on the packet path.

The nft_compat layer allows legacy xtables extensions to be loaded from newer nftables rulesets. This compatibility bridge did not previously enforce family restrictions on the loaded targets. As a result, a user with sufficient privileges could install a bridge-family rule that referenced the xt_nat SNAT or DNAT target, even though bridge frames have no associated IP-family conntrack state.

Root Cause

The root cause is missing input validation in the target checkentry callback. The xt_nat_checkentry() function did not reject non-IP protocol families before allowing the target to be installed. Once loaded into a bridge-family chain, the target's runtime path calls nf_nat_setup_info() and dereferences conntrack pointers that were never established for the frame, producing a NULL pointer dereference in kernel context.

Attack Vector

Exploitation requires local access and CAP_NET_ADMIN in the current network namespace, which typically implies root or an administratively delegated capability. An attacker with these privileges can craft an nftables rule via nft_compat that attaches an xt_nat SNAT or DNAT target to a bridge-family chain. Traffic traversing the chain then triggers the NULL pointer dereference and crashes the kernel. The runtime crash was already mitigated by commit 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), and this patch adds defense in depth by rejecting the invalid configuration at rule installation time.

No verified public exploit code is available for this issue. Technical details are documented in the upstream stable commits, including 0afc9ad, 49abe56, 4fbc2ba, 5d1a224, 679ced2, a842dab, e35c048, and ec88fa7.

Detection Methods for CVE-2026-80664

Indicators of Compromise

Kernel oops or panic messages referencing nf_nat_setup_info or xt_nat in dmesg or /var/log/kern.log.
Unexpected host reboots or hangs correlated with nft or iptables-compat rule loading events.
Presence of nftables rules in the bridge family that reference legacy SNAT or DNAT xtables targets.

Detection Strategies

Audit installed nftables rulesets with nft list ruleset and search bridge-family chains for xt compat targets named SNAT or DNAT.
Monitor kernel logs for NULL pointer dereference stack traces originating in netfilter NAT code paths.
Track use of CAP_NET_ADMIN in non-root workloads and containers via Linux audit rules on netlink socket operations.

Monitoring Recommendations

Enable auditd rules for setsockopt and netlink NFNL_SUBSYS_NFTABLES messages to record rule installations.
Forward kernel ring buffer output to a centralized log platform to correlate crash traces across the fleet.
Alert on repeated oops events from the same host, which may indicate iterative exploitation attempts.

How to Mitigate CVE-2026-80664

Immediate Actions Required

Update to a Linux kernel that includes the fix commits listed in the NVD references and reboot affected hosts.
Restrict CAP_NET_ADMIN to trusted administrators and remove it from unprivileged container profiles.
Inventory hosts running bridge-family nftables rules that use xtables compat targets and remediate misconfigurations.

Patch Information

The fix is applied by adding a family check in xt_nat_checkentry() so that only NFPROTO_IPV4, NFPROTO_IPV6, and NFPROTO_INET can install the target. Distribution kernels should pull the corresponding backport. Relevant upstream commits include Kernel Commit 0afc9ad, Kernel Commit 49abe56, Kernel Commit 4fbc2ba, Kernel Commit 5d1a224, Kernel Commit 679ced2, Kernel Commit a842dab, Kernel Commit e35c048, and Kernel Commit ec88fa7.

Workarounds

Unload the xt_nat module on hosts that do not require legacy xtables NAT compatibility using modprobe -r xt_nat.
Blocklist loading of xt_nat and nft_compat in /etc/modprobe.d/ where the compatibility layer is not needed.
Enforce Linux Security Module (LSM) policies such as SELinux or AppArmor to prevent unprivileged workloads from opening NETLINK_NETFILTER sockets.

bash

# Configuration example
# Prevent loading of the vulnerable compat modules where not required
echo 'install xt_nat /bin/true' | sudo tee /etc/modprobe.d/disable-xt_nat.conf
echo 'install nft_compat /bin/true' | sudo tee -a /etc/modprobe.d/disable-xt_nat.conf

# Audit existing bridge-family rules that may reference legacy NAT targets
sudo nft -a list ruleset | grep -iE 'bridge|SNAT|DNAT'