CVE-2026-98321: netfilter: nf_nat: unregister and release hooks on error

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnat: unregister and release hooks on error

If nfhookentriesinsertraw() fails, the NAT hooks get never released, resulting in a memleak.

Postpone setting natprotonet->nathookops when the hooks are registered to simplify the error path to decide whether the nat hooks need unwinding.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:46 AM

Data Sourced

via MITRE·08:46 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

What condition triggers the memory leak?

The leak occurs when nf_hook_entries_insert_raw() fails while NAT hooks are being registered. In that error path, the NAT hooks are not released.

What is the security impact described for this issue?

The described impact is a memory leak caused by unreleased NAT hooks. No additional impacts, exploitation prerequisites, or affected configurations are provided.

What indicates that a system may be affected?

The provided information does not specify observable symptoms or detection methods. The relevant failure condition is an nf_hook_entries_insert_raw() registration failure.

CVE-2026-98321: netfilter: nf_nat: unregister and release hooks on error

Affected Software

Event History

Frequently Asked Questions

What condition triggers the memory leak?

What is the security impact described for this issue?

What indicates that a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

What condition triggers the memory leak?

What is the security impact described for this issue?

What indicates that a system may be affected?