Disclosed at Black Hat USA 2026 by researcher Malcolm Stagg, NatJack is an attack class exploiting trust assumptions in Network Address Translation (NAT) connection tracking tables. It allows a co-tenant or adjacent user sharing a NAT boundary to hijack TCP sessions, poison DNS responses, or cause a denial of service without layer-2 access.
"For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because the conntrack logic failed to validate its direction. Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1."
OpenWRT 25.12.5 ships with kernel 6.12.94 (which is patched) but versions before this such as 25.12.4 have the 6.12.87 kernel. It is recommended to update if not already even if the scope of attack is very low. Please see below for a scenario that would have to happen:
"you are most likely not at risk of an attack. For an attack to be performed, an untrusted privileged user would generally need be located behind your router. For most home users, this is not a common scenario or threat."
If you are a home user with a consumer-grade router, your router is very likely vulnerable, but you are most likely not at risk of an attack. For an attack to be performed, an untrusted privileged user would generally need be located behind your router. For most home users, this is not a common scenario or threat.
~ from the website (emphasis added by original author)
NAT is and never was a "security" feature. If someone tells you otherwise you can happily ignore this dullhead.
Second, that NAT can be transversed is also no news. Over the last decades this happened multiple times.
And @gameinn if you want to provide a foundation for a constructive discussion.... Don't you think it would be helpful to either be more verbose and descriptive or at least point and link to a proper source so everyone and not only you knows what's all about?
For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because the conntrack logic failed to validate its direction. Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
So @gameinn you just need to do the leg work and compare the version numbers....