The Linux kernel’s netfilter extended NAT module may dereference a NULL pointer when an unsupported network family rule is instantiated through nft_compat. The flaw is triggered by assuming the IP‑family conntrack state is always present for SNAT and DNAT handlers, which is not true for non‑IP families. If the fault occurs, the kernel crashes, causing a denial of service on the affected host. The vulnerability does not grant an attacker confidentiality or integrity access, but it can interrupt network processing. Affected systems include all Linux kernel builds that ship the netfilter xt_nat module and have not incorporated the commit that rejects non‑IP families during target installation. Affected kernel versions were those prior to including the patch referenced in the commit message. Risk and exploitability: The flaw is local and requires manipulation of the nft_compat rule set, attainable only by a privileged or compromised process. The EPSS score of < 1% reflects a very low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The crash outcome gives a high severity impact if an attacker succeeds, but the low exploitation probability keeps the overall risk moderate.

All Linux kernel builds that ship the netfilter xt_nat module and have not applied the patch that rejects non‑IP families during target installation. Prior to the inclusion of the commit that enforces family checks in xt_nat_checkentry(), systems using nft_compat rules for unsupported families were susceptible.

The vulnerability is local and requires control over nft_compat rules, typically obtainable by a privileged user. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the issue is absent from the CISA KEV catalog. A successful exploitation would cause a kernel crash and a denial of network services, representing a high severity impact. The CVSS score is 7.3, indicating a high severity impact. Updating the kernel to include the patch removes the vulnerable code path and mitigates the risk.