CVE-2026-80668
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Aug 28, 2026
CISA due date
—
Cloudanix analysis
A flaw in how Linux tracks network connections could let an attacker crash servers or take them over by sending specially timed network traffic.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Race condition in nf_conntrack_expect allows an expectation to dereference a stale exp->master pointer after the master conntrack is released when timer deletion races with expectation removal.
Why it matters to the business
Attackers can trigger kernel memory corruption leading to system crashes, denial of service, or potential arbitrary code execution on exposed Linux systems handling network connections.
How an attack unfolds
An attacker sends crafted network traffic that creates and rapidly invalidates conntrack expectations while the timer-based cleanup races with removal, causing the kernel to access freed memory during expectation lookup or insertion.
How to fix it
Update the Linux kernel to a version containing the GC-worker replacement for expectation timers. Reboot affected systems after applying the fix. No configuration changes are required.
How to confirm the fix worked
Confirm the kernel version includes the nf_conntrack_expect GC worker changes; run 'uname -r' and cross-reference against the upstream commit that replaced the timer API.
Typical attack path
- Send packets that trigger expectation creation via a helper or related protocol
- Force rapid invalidation or removal of the master conntrack entry
- Time the operation so that the expectation timer fires after the master is freed
- Trigger expectation insertion or lookup to dereference the stale pointer
How to detect it
Inspect kernel logs for oops or panic messages referencing nf_conntrack_expect, nf_ct_remove_expectations, or stale master pointers; review conntrack hash table operations around the time of any crashes.
What your security team should do
- Prioritize kernel updates on all internet-facing Linux systems within the next 7 days due to the critical CVSS score
- Monitor for unexpected conntrack-related kernel panics in system logs
- Apply the patch across the fleet before the 60-day mark from publication
The record
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false. Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy. Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|