In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

We ran into below KASAN splat, which is mostly uninteresting, beside
for having nf_nat_register_fn() in the call chain as a cause for the
offending access:

==================================================================
BUG: KASAN: slab-out-of-bounds in nf_nat_register_fn+0x5f9/0x640
Read of size 8 at addr ffff890031e54c20 by task iptables/9510

CPU: 0 UID: 0 PID: 9510 Comm: iptables Not tainted 6.18.18-grsec-full-20260320181326 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 […] dump_stack_lvl+0xee/0x160 ffff88004117eeb8
 […] print_report+0x6e/0x640 ffff88004117eee0
 […] ? __phys_addr+0x8e/0x140 ffff88004117eef0
 […] ? kasan_addr_to_slab+0x51/0xe0 ffff88004117ef08
 […] ? complete_report_info+0xec/0x1c0 ffff88004117ef20
 […] ? nf_nat_register_fn+0x5f9/0x640 ffff88004117ef48
 […] kasan_report+0xbc/0x140 ffff88004117ef50
 […] ? nf_nat_register_fn+0x5f9/0x640 ffff88004117ef90
 […] nf_nat_register_fn+0x5f9/0x640 ffff88004117eff8
 […] ? nf_nat_icmp_reply_translation+0x6e0/0x6e0 ffff88004117f070
 […] nf_tables_register_hook.part.0+0xa0/0x220 ffff88004117f080
 […] nf_tables_addchain.constprop.0+0x1054/0x1fc0 ffff88004117f0b8
 […] ? nft_chain_lookup.part.0+0x4ce/0xac0 ffff88004117f130
 […] ? nf_tables_abort+0x3d80/0x3d80 ffff88004117f190
 […] ? nf_tables_dumpreset_obj+0x100/0x100 ffff88004117f1c8
 […] ? nft_table_lookup.part.0+0x255/0x300 ffff88004117f310
 […] ? nf_tables_newchain+0x21a4/0x2fa0 ffff88004117f358
 […] nf_tables_newchain+0x21a4/0x2fa0 ffff88004117f360
 […] ? nf_tables_addchain.constprop.0+0x1fc0/0x1fc0 ffff88004117f458
 […] ? nla_get_range_signed+0x4a0/0x4a0 ffff88004117f488
 […] ? lock_acquire+0x16f/0x320 ffff88004117f490
 […] ? find_held_lock+0x3b/0xe0 ffff88004117f4b0
 […] ? __nla_parse+0x45/0x80 ffff88004117f500
 […] nfnetlink_rcv_batch+0xbca/0x19a0 ffff88004117f550
 

https://git.kernel.org/stable/c/069cfe3de2a5e16069485893cd04665ab769c1d8

https://git.kernel.org/stable/c/359d8ff97362a4662356104540e4814bff9dad7c

https://git.kernel.org/stable/c/87f7a720de2545fdac29c85acb7163676feacdaf

https://git.kernel.org/stable/c/a73e7ac3f3b69e9581ec7bfd889ff3e9b8c773f7

https://git.kernel.org/stable/c/e794f633021defcfa98e17d73b955cd07590831f

https://git.kernel.org/stable/c/eb14aba91163c33d8c99f9d7c06690e08b56a250

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_nat_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"359d8ff97362a4662356104540e4814bff9dad7c","versionType":"git","status":"affected"},{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"87f7a720de2545fdac29c85acb7163676feacdaf","versionType":"git","status":"affected"},{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"e794f633021defcfa98e17d73b955cd07590831f","versionType":"git","status":"affected"},{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"a73e7ac3f3b69e9581ec7bfd889ff3e9b8c773f7","versionType":"git","status":"affected"},{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"eb14aba91163c33d8c99f9d7c06690e08b56a250","versionType":"git","status":"affected"},{"version":"cbc1dd5b659f5a2c3cba88b197b7443679bb35a0","lessThan":"069cfe3de2a5e16069485893cd04665ab769c1d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_nat_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]