CVE-2026-98793

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: reject invalid NAT manipulation types

As bpf ct set nat info() is not validating the NAT manipulation type a wrong value can be passed directly to nf nat setup info(). This triggers the WARN ON() at nf nat setup info() and if panic on warn isn't set, then IPS SRC NAT DONE is set without adding nat bysource and conntrack cleanup tries to unlink an uninitialized hlist node.

Fix this by checking that NAT manipulation type is correct before calling nf nat setup info(). In addition, if the WARN ON is hit, return NF DROP instead of continuing with the processing to avoid similar situations in the future.