CVE-2026-98321: netfilter: nf_nat: unregister and release hooks on error
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnat: unregister and release hooks on error
If nfhookentriesinsertraw() fails, the NAT hooks get never released, resulting in a memleak.
Postpone setting natprotonet->nathookops when the hooks are registered to simplify the error path to decide whether the nat hooks need unwinding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition triggers the memory leak?
The leak occurs when nf_hook_entries_insert_raw() fails while NAT hooks are being registered. In that error path, the NAT hooks are not released.
What is the security impact described for this issue?
The described impact is a memory leak caused by unreleased NAT hooks. No additional impacts, exploitation prerequisites, or affected configurations are provided.
What indicates that a system may be affected?
The provided information does not specify observable symptoms or detection methods. The relevant failure condition is an nf_hook_entries_insert_raw() registration failure.