CVE-2026-80636

What it actually does

The flaw leaves conntrack extension pointers NULL for unconfirmed connections after the genid infrastructure was removed, allowing code paths that dereference those pointers without NULL checks to trigger kernel memory corruption or panic.

Why it matters to the business

Network-intensive Linux systems can experience sudden kernel crashes or instability when handling new connections, leading to unplanned downtime and service disruption.

How an attack unfolds

An attacker triggers creation of an unconfirmed conntrack entry and then causes kernel code to access its extension data structures, resulting in a NULL dereference that crashes the system.

How to fix it

Apply the kernel patch that reverts commit c56716c69ce1 and restores safe handling of ct extensions for unconfirmed connections; update to a kernel version containing this revert.

How to confirm the fix worked

Confirm the revert patch is present in the running kernel source or binary; test conntrack creation under load and verify no NULL dereference panics occur in extension code paths.

Typical attack path

1. Send crafted or high-volume network traffic that creates unconfirmed conntrack entries
2. Force execution of conntrack helper or extension lookup paths without prior confirmation
3. Trigger NULL pointer dereference in extension handling code
4. Cause kernel panic or memory corruption leading to denial of service

How to detect it

Review kernel logs for oops or panic messages mentioning nf_conntrack, ct extensions, or NULL pointer dereferences during conntrack processing.

What your security team should do

• Prioritize patching kernel on all systems that use netfilter conntrack
• Monitor for kernel oops or panic logs related to nf_conntrack
• Limit exposure by disabling unnecessary conntrack helpers until patched