CVE-2026-80637

What it actually does

Unprotected direct memory reads and writes of TCP timestamp fields in netfilter synproxy allow unaligned access, triggering hardware faults or expensive emulation on strict-alignment architectures and causing kernel crashes or performance loss during connection handling.

Why it matters to the business

Linux systems performing stateful network proxying or SYN cookie operations may experience sudden reboots or throughput degradation when processing ordinary TCP traffic, disrupting services that rely on the kernel's networking stack.

How an attack unfolds

An attacker sends TCP segments containing timestamp options to a system using synproxy; the option parser performs direct unaligned loads/stores on the timestamp value, which on certain CPU architectures faults or traps, leading to a kernel panic or soft lockup.

How to fix it

Upgrade the Linux kernel to a version containing the referenced commit that replaces the direct accesses with get_unaligned_be32 and put_unaligned_be32; rebuild and reboot affected hosts. No configuration workaround exists.

How to confirm the fix worked

Confirm the running kernel source contains calls to get_unaligned_be32/put_unaligned_be32 inside net/netfilter/nf_synproxy_core.c or the equivalent packaged kernel version; re-test with TCP packets carrying timestamp options and verify absence of alignment faults in dmesg.

Typical attack path

1. Attacker sends crafted TCP SYN or ACK packets with TCP timestamp options toward a synproxy-protected listener.
2. synproxy_parse_options executes the unsafe direct memory access on the timestamp field.
3. On strict-alignment hardware the access faults, producing a kernel oops or panic and terminating the connection or crashing the system.

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing nf_synproxy_core, synproxy_parse_options, or unaligned access faults; correlate with inbound TCP flows containing timestamp options.

What your security team should do

• Schedule kernel updates for all Linux hosts within the next maintenance window given the 32-day publication age and stable EPSS.
• Monitor kernel logs for alignment-related oops entries involving nf_synproxy or tcp_parse_options.
• Prioritize systems that expose synproxy or perform SYN cookies to external networks.