CVE-2026-80636: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80636 Overview

CVE-2026-80636 is a Linux kernel vulnerability in the netfilter connection tracking (conntrack) subsystem. The flaw stems from the connection tracking extension generation ID (genid) infrastructure, which disables all conntrack extensions for unconfirmed conntracks. Kernel code paths that dereference these extensions without a NULL check can trigger a crash. The fix reverts commit c56716c69ce1 ("netfilter: extensions: introduce extension genid count"), since the infrastructure became obsolete after conntrack timeout and helper objects were moved to datapath refcounting. The vulnerability affects Linux kernel builds that shipped the reverted genid infrastructure.

Critical Impact
The bug can cause a kernel NULL pointer dereference, resulting in a kernel crash and denial of service on affected Linux hosts processing network traffic through netfilter conntrack.

Affected Products

Linux kernel versions containing commit c56716c69ce1 ("netfilter: extensions: introduce extension genid count")
Distributions shipping the affected upstream conntrack extension genid infrastructure
Any Linux system using netfilter with connection tracking helpers or timeouts on the affected kernels

Discovery Timeline

2026-08-28 - CVE-2026-80636 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80636

Vulnerability Analysis

The issue lives in the Linux kernel netfilter conntrack extension subsystem. The reverted commit introduced a generation ID counter intended to invalidate conntrack extensions during runtime reconfiguration of conntrack helpers and timeouts. The mechanism marks extensions as unavailable by returning NULL for unconfirmed conntracks. However, the change was broader than needed. It disables every extension type rather than only helpers and timeouts, and existing callers were not audited to guard against NULL returns. When a caller dereferences a returned extension pointer without a check, the kernel triggers a NULL pointer dereference and panics. The upstream maintainers reverted the infrastructure because refcounting on the datapath now handles helper and timeout object lifetimes, removing the original justification for genid tracking.

Root Cause

The root cause is an unsafe broadening of the extension invalidation logic combined with call sites that assume conntrack extensions are always present. The genid check returns NULL for unconfirmed connections across all extension types, while several kernel paths dereference the pointer directly. This is a Null Pointer Dereference condition in a privileged kernel subsystem reachable through routine network traffic processing.

Attack Vector

Exploitation requires network packets that traverse a conntrack-enabled netfilter pipeline on a vulnerable kernel. Traffic that creates unconfirmed conntrack entries and exercises the affected extension paths can reach the vulnerable dereference. A successful trigger produces a kernel oops or panic, denying service to the host. The vulnerability does not require authentication when the affected host is exposed to attacker-controlled traffic. No public proof-of-concept has been published at the time of NVD publication.

No verified exploitation code is available. Technical details are documented in the upstream commits listed under external references.

Detection Methods for CVE-2026-80636

Indicators of Compromise

Kernel oops or panic messages referencing nf_ct_ext, nf_conntrack, or conntrack helper and timeout functions in dmesg or /var/log/kern.log
Unexpected host reboots or network stack failures on Linux systems running netfilter with conntrack helpers enabled
Crash stack traces showing NULL pointer dereference within the netfilter conntrack extension path

Detection Strategies

Inventory running kernels using uname -r and cross-reference against distribution advisories for the patched commits (35e21a4, 61eab1d, 6bba484, a052a94, d53eecb)
Monitor kernel ring buffer output for repeated conntrack-related panics that indicate active triggering of the vulnerable code path
Correlate kernel crash telemetry with network traffic patterns targeting services that rely on conntrack helpers such as FTP, SIP, or TFTP

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging platform for retention and analysis
Enable kdump on production Linux hosts so crash cores are captured for post-incident forensics
Track availability metrics on Linux gateways, firewalls, and NAT devices to detect denial-of-service conditions caused by repeated kernel panics

How to Mitigate CVE-2026-80636

Immediate Actions Required

Apply the upstream kernel patches that revert the extension genid infrastructure as soon as vendor packages become available
Prioritize patching Linux hosts exposed to untrusted network traffic, including firewalls, load balancers, and NAT gateways
Subscribe to distribution security channels (Red Hat, SUSE, Debian, Ubuntu, Oracle) to receive backported fixes for supported kernel branches

Patch Information

The fix is delivered through the following upstream kernel commits: Kernel Git Commit 35e21a4, Kernel Git Commit 61eab1d, Kernel Git Commit 6bba484, Kernel Git Commit a052a94, and Kernel Git Commit d53eecb. Each commit reverts the extension genid tracking code and restores safe behavior for conntrack extension access.

Workarounds

Where the netfilter conntrack helper subsystem is not required, disable specific helpers using nf_conntrack_helper=0 sysctl or unload optional helper modules
Restrict inbound traffic to services that rely on conntrack helpers using perimeter firewall rules until patches are deployed
Schedule reboots into patched kernels during maintenance windows and validate dmesg output afterward for absence of conntrack-related warnings

bash

# Configuration example
# Verify running kernel version
uname -r

# Disable automatic conntrack helper assignment (temporary hardening)
sysctl -w net.netfilter.nf_conntrack_helper=0

# Persist across reboots
echo 'net.netfilter.nf_conntrack_helper=0' >> /etc/sysctl.d/99-conntrack.conf

# After patching, reboot and confirm no conntrack panics
reboot
dmesg | grep -i conntrack