CVE-2026-98322

A flaw rated Moderate impact affects the Linux kernel's netfilter nftables NAT implementation in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases built on RHEL CoreOS 9. When an IPv4 NAT rule using the nftables netmap feature is configured, nft_nat_setup_netmap() writes only the 4-byte IPv4 member of the 16-byte on-stack union nf_inet_addr before copying the whole union into the NAT range, so up to 12 bytes of uninitialized kernel stack data reach nf_nat_setup_info() and are processed during packet evaluation. A local user with the network administration privileges (CAP_NET_ADMIN) needed to configure nftables rules could exploit this flaw to cause a denial of service, and the processed uninitialized stack data could potentially expose limited kernel memory, although no information disclosure has been demonstrated. The IPv6 netmap path initializes all 16 bytes of the union and is not affected. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform releases built on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those releases. For the affected products, the fix is currently deferred: given the moderate impact of the flaw and the requirement for local administrative privileges to trigger it, a fix is not planned for these releases at this time. The residual risk is that systems using IPv4 netmap NAT rules may experience a denial of service or, at most, limited exposure of uninitialized kernel stack data.