CVE-2026-80603

Received Received - Intake

Buffer Overflow in Linux Kernel Netfilter IRC Module

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte. The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer(). irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read. Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80603

EUVD

EUVD-2026-67479

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the Linux kernel's netfilter connection tracking module for IRC protocol. The parse_dcc() function incorrectly treats a pointer as inclusive when it should be exclusive, leading to reading one byte beyond the valid data region. This can result in incorrect parsing of DCC commands, potentially exposing wrong IP or port information in the connection tracking expectation.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter IRC connection tracking module. Detection requires checking kernel logs for related errors or inspecting the kernel version for affected releases. Commands like 'dmesg | grep nf_conntrack_irc' or 'uname -a' may help identify exposure.

Impact Analysis

If exploited, this vulnerability could allow an attacker to manipulate IRC DCC protocol parsing, leading to incorrect connection tracking entries. This might enable unauthorized data transfers or bypass network security controls. However, the impact is limited as the stray read does not cause memory corruption due to an extra allocation byte acting as a guard.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-severity out-of-bounds read in the Linux kernel's IRC connection tracking, which could lead to incorrect data parsing but does not involve data exposure or unauthorized access.

Mitigation Strategies

Apply the latest kernel security updates to patch the nf_conntrack_irc flaw. If immediate patching is not possible, disable the IRC connection tracking module with 'modprobe -r nf_conntrack_irc' or restrict IRC traffic via firewall rules.

Hi! I’m here to help you understand CVE-2026-80603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70