Answer in brief
CVE-2026-80664 records a Unknown severity vulnerability in netfilter: xt_nat: reject unsupported target families. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c7232c9979cba684c50b64c513c4a83c9aa70563 <49abe564391411057a26a9a943c8e17867c3b9b4 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <a842dab87cab29f2a5798a47b2dc5e6a449950bf || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <e35c048d7511e9d4c2a537b8a231c49606e97c16 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <679ced28a9dc2f6dc679eb05027d779693e60902 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <ec88fa71c82072e9189983b05b499d3507550271 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <5d1a2240935ea47e2673d0ea17fdb058e4dc91dd | 49abe564391411057a26a9a943c8e17867c3b9b4, 0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82, 4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777, a842dab87cab29f2a5798a47b2dc5e6a449950bf, e35c048d7511e9d4c2a537b8a231c49606e97c16, 679ced28a9dc2f6dc679eb05027d779693e60902, ec88fa71c82072e9189983b05b499d3507550271, 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd |
| Linux/Linuxgeneric | 3.7 | Not reported |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]
Quoted source text, attributed separately from HOL analysis.