{"cve":"CVE-2026-98322","nvd":{"published":"2026-10-06T09:18:24.243","modified":"2026-10-19T10:18:34.350","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_nat: fully initialise new_addr in netmap setup\n\nnft_nat_setup_netmap() builds the mapped address in an on-stack\nunion nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip\nmember and the loop runs a single 32-bit iteration, but it then copies\nthe whole 16-byte union into range->min_addr and range->max_addr, so the\nupper 12 bytes reach nf_nat_setup_info() uninitialised.\n\nKMSAN reports an uninit-value in nf_nat_setup_info() reached from\nnft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.\n\nZero-initialise new_addr.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451","https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a","https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb","https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e","https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:57:46.668721662+00:00"},"epss":{"cve":"CVE-2026-98322","score":0.00184,"percentile":0.07961,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}