CVE-2026-80603: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80603 Overview

CVE-2026-80603 is an off-by-one out-of-bounds read vulnerability in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_irc connection tracking helper. The flaw resides in the parse_dcc() function, which treats data_end as an inclusive end pointer while its only caller passes data_limit = ib_ptr + datalen, a value that points one byte past the last valid buffer byte. The mismatch allows a one-byte read beyond the region populated by skb_header_pointer(). Because the underlying irc_buffer is allocated with an extra byte, the read does not fault, but it returns uninitialized or stale memory that can corrupt DCC IP and port values in conntrack expectations.

Critical Impact
Remote attackers can trigger the out-of-bounds read over the network without authentication, potentially poisoning conntrack DCC expectations and leaking uninitialized kernel memory into IRC session state.

Affected Products

Linux kernel builds with CONFIG_NF_CONNTRACK_IRC enabled
Distributions shipping the vulnerable nf_conntrack_irc helper prior to the upstream fix
Systems using IRC connection tracking or IRC NAT helpers in netfilter

Discovery Timeline

2026-08-28 - CVE-2026-80603 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80603

Vulnerability Analysis

The vulnerability lives in parse_dcc() inside net/netfilter/nf_conntrack_irc.c. The function scans for a newline terminator across an IRC DCC message buffer. The newline search loop iterates while tmp <= data_end, but the caller supplies data_limit = ib_ptr + datalen, which is an exclusive upper bound. When no newline is present, the loop dereferences *tmp at tmp == data_end, reading one byte beyond the data written by skb_header_pointer().

The irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes, and datalen is capped at MAX_SEARCH_SIZE. The extra allocation byte keeps the stray read from faulting, but the byte is uninitialized or stale kernel memory. This condition maps to [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is an inclusive/exclusive pointer convention mismatch between parse_dcc() and its caller. The function comment and loop treat data_end as pointing to the last valid byte, while the caller passes a one-past-the-end pointer. The upstream fix converts the loop and post-loop check to strict less-than comparisons, aligning both with the exclusive-end convention.

Attack Vector

An unauthenticated remote attacker can craft an IRC DCC message that lacks a newline terminator and traverses a Linux router or endpoint running the nf_conntrack_irc helper. When parse_dcc() processes the payload, the trailing byte read may contain an ASCII digit from prior slab contents. simple_strtoul will then consume that byte and produce an incorrect DCC IP or port in the resulting conntrack expectation. This can misdirect subsequent DCC flows or bypass expected NAT/firewall behavior, and any change to MAX_SEARCH_SIZE or allocation size converts the flaw into a true out-of-bounds read.

No verified public exploit code is currently available. See the upstream commits under the Linux kernel stable tree for the technical patch details.

Detection Methods for CVE-2026-80603

Indicators of Compromise

Unexpected conntrack DCC expectations with anomalous or non-routable IP addresses and ports on hosts running IRC connection tracking.
Kernel log anomalies or KASAN reports referencing parse_dcc or nf_conntrack_irc when running instrumented kernels.
Inbound IRC traffic containing DCC control messages without trailing newlines directed at Linux gateways.

Detection Strategies

Audit loaded kernel modules for nf_conntrack_irc and correlate with the running kernel version against patched stable releases.
Deploy KASAN or KMSAN builds in test environments to detect the one-byte OOB read during fuzzing of IRC helper traffic.
Monitor netfilter conntrack expectation tables for DCC entries with implausible endpoint values.

Monitoring Recommendations

Alert on IRC DCC traffic traversing gateways where the IRC helper is loaded but not operationally required.
Track kernel version and module state across the fleet to identify hosts still exposing the vulnerable helper.
Ingest kernel and netfilter logs into a centralized analytics platform to correlate conntrack anomalies with network-side IRC activity.

How to Mitigate CVE-2026-80603

Immediate Actions Required

Apply the upstream stable kernel updates that switch parse_dcc() to strict less-than pointer comparisons.
Unload or blacklist the nf_conntrack_irc module on hosts that do not require IRC connection tracking.
Inventory Linux systems exposing netfilter helpers to untrusted networks and prioritize patching those first.

Patch Information

The fix is available across multiple stable branches. Reference the upstream commits: Commit 2393f0bd7a46, Commit 2b70f61f569b, Commit 437e0a3854b3, Commit 910c33e4a8c0, Commit abb8c32b88ea, Commit aff589556ed7, Commit eeef3b81f449, and Commit ef6400ca25a1. Rebuild or install vendor kernels that incorporate these commits.

Workarounds

Disable the IRC connection tracking helper by unloading nf_conntrack_irc where IRC DCC support is not required.
Block or drop IRC and DCC traffic at perimeter firewalls on hosts that cannot be patched immediately.
Restrict conntrack helper auto-attachment using nftables or iptables CT helper rules so the vulnerable helper only processes explicitly permitted flows.

bash

# Configuration example
# Unload and blacklist the vulnerable IRC conntrack helper
sudo modprobe -r nf_conntrack_irc
echo "blacklist nf_conntrack_irc" | sudo tee /etc/modprobe.d/blacklist-nf_conntrack_irc.conf

# Disable automatic helper assignment (nftables)
sudo sysctl -w net.netfilter.nf_conntrack_helper=0