act_nat can process packets whose protocol is not IPv4 and then interpret the payload as an IPv4 header. Non-IPv4 packets may be modified based on unrelated bytes at the network header offset. The action is documented as IPv4 NAT and should leave other protocols alone. Check the packet protocol before parsing and rewriting the IPv4 header. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- net/sched/act_nat.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c index abb332dee836..34d6ba2d4143 100644 --- a/net/sched/act_nat.c +++ b/net/sched/act_nat.c @@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb, egress = parms->flags & TCA_NAT_FLAG_EGRESS; noff = skb_network_offset(skb); + if (skb_protocol(skb, true) != htons(ETH_P_IP)) + goto out; + if (!pskb_may_pull(skb, sizeof(*iph) + noff)) goto drop; -- 2.43.0