CVE-2026-80668
massUse-after-free race in Linux kernel netfilter conntrack expectations
CVE-2026-80668 is a race condition (use-after-free) in the Linux kernel's netfilter connection-tracking expectation code: when an expectation's expiry timer races with expectation removal, the expectation can dereference a stale exp->master pointer that has already been released. The flaw is reachable over the network on systems that create conntrack expectations, such as gateways using helper-based ALGs or nft_ct expectations. An attacker could trigger kernel memory corruption and a crash (denial of service), and the critical 9.8 CVSS (network vector, no privileges, high C/I/A) indicates potential for full kernel compromise. Any Linux deployment running nf_conntrack with expectations - routers, firewalls, NAT gateways, container and cloud hosts - is plausibly affected, although the buggy path is only exercised when conntrack expectations are created. No public PoC, in-the-wild exploitation or KEV listing is known, and EPSS estimates a 0.4% probability of exploitation within 30 days.
What to do: Track your distribution's advisory for CVE-2026-80668 and upgrade to a kernel release containing this netfilter fix once it reaches your vendor's stable channel; no fixed version numbers are available in the current data. As interim mitigation, restrict conntrack helper usage on exposed gateways (e.g., disable automatic helper assignment and unnecessary ALG helpers such as FTP/SIP).
| Linux kernel (netfilter nf_conntrack_expect) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false. Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy. Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.