The Linux kernel netfilter module’s xt_nat target handlers can dereference a NULL pointer when a rule from an unsupported network family is instantiated through nft_compat, causing a kernel crash and local denial of service. This flaw does not compromise confidentiality or integrity, but it can render network services unavailable on affected hosts.

All Linux kernel builds that ship the netfilter xt_nat module are potentially vulnerable unless they include the patch that rejects non‑IP families during target installation. The precautionary commit 9dbba7e694ec mitigates the flaw by enforcing family checks in xt_nat_checkentry().

The vulnerability is local and requires an attacker to influence the nft_compat rule set, which may be achievable by compromising a privileged process. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting a moderate overall risk. The CVSS score is absent from the data, but the crash indicates a high severity impact if exploited. Applying the patch eliminates the vulnerable code path and removes the risk.