CVE-2026-80668

Received Received - Intake

Memory Leak in Linux Kernel Netfilter Expectations

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false. Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy. Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80668

EUVD

EUVD-2026-67544

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a change in how expired network connection expectations are managed. Instead of using timer APIs, the patch introduces a garbage collection (GC) worker to clean up expired expectations. This approach synchronizes better with other subsystems and prevents race conditions where expired expectations might access invalid memory. The patch also adds a new flag to handle expectations marked for removal and ensures proper cleanup during error paths.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter connection tracking subsystem. Detection requires checking kernel logs for related errors or kernel panics. Commands like dmesg | grep -i conntrack or journalctl -k | grep -i nf_conntrack_expect may reveal issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability primarily affects systems running vulnerable Linux kernel versions. It could lead to memory corruption or crashes if exploited, potentially causing denial-of-service conditions. Systems relying on network connection tracking for security or performance may experience instability or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical fix in the Linux kernel's netfilter subsystem related to connection tracking expectations, which does not involve data privacy, security controls, or regulatory requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the patch for this vulnerability. Reboot the system to apply the updated kernel. Monitor system logs for any signs of exploitation or instability after the update.

Hi! I’m here to help you understand CVE-2026-80668. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70