Answer in brief
CVE-2026-80664 records a High severity (CVSS 7.3) vulnerability in netfilter: xt_nat: reject unsupported target families. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c7232c9979cba684c50b64c513c4a83c9aa70563 <49abe564391411057a26a9a943c8e17867c3b9b4 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <a842dab87cab29f2a5798a47b2dc5e6a449950bf || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <e35c048d7511e9d4c2a537b8a231c49606e97c16 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <679ced28a9dc2f6dc679eb05027d779693e60902 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <ec88fa71c82072e9189983b05b499d3507550271 || >=c7232c9979cba684c50b64c513c4a83c9aa70563 <5d1a2240935ea47e2673d0ea17fdb058e4dc91dd | 49abe564391411057a26a9a943c8e17867c3b9b4, 0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82, 4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777, a842dab87cab29f2a5798a47b2dc5e6a449950bf, e35c048d7511e9d4c2a537b8a231c49606e97c16, 679ced28a9dc2f6dc679eb05027d779693e60902, ec88fa71c82072e9189983b05b499d3507550271, 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd |
| Linux/Linuxgeneric | 3.7 | Not reported |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]
Quoted source text, attributed separately from HOL analysis.