Linux Kernel Netfilter NULL Pointer Dereference in xt_nat

CVE-2026-80664 is a kernel-level NULL pointer dereference vulnerability in Linux's netfilter xt_nat module that affects SNAT and DNAT target handlers. The vulnerability exists because these handlers assume IP-family conntrack state is present but fail to validate the target family before dereferencing memory, allowing unsupported families (particularly bridge-family rules) to trigger a crash in nf_nat_setup_info(). This matters significantly because netfilter is fundamental to Linux network packet filtering and NAT operations across enterprise infrastructure, cloud deployments, and edge systems. Any system running vulnerable kernel versions with netfilter compat rules enabled is at risk of denial-of-service through a simple malformed rule instantiation, with potential for privilege escalation depending on execution context.

While CVE-2026-80664 lacks explicit MITRE ATT&CK mappings, Casky's AI-powered analysis would identify this as a defensive evasion and execution chain vulnerability. Using extended reasoning across its 754 security skills, practitioners would see detection patterns aligned with T1562 (Impair Defenses—specifically disabling network security controls), T1499 (Resource Exhaustion via denial-of-service), and T1203 (Exploitation for Code Execution). Casky would flag kernel source analysis findings showing missing input validation in checkentry functions, unsafe pointer operations in nf_nat_setup_info(), and the attack surface exposed through nft_compat bridge rules. Practitioners monitoring vulnerability patterns would observe signature characteristics: suspicious netfilter rule creation attempts, kernel crash logs with NULL dereference backtraces, and anomalous traffic patterns attempting to trigger the vulnerability through crafted NAT rules—all indicators Casky's threat modeling capability would correlate to active exploitation attempts in their environment.