CVE-2026-80637 Overview
CVE-2026-80637 is a Linux kernel vulnerability in the netfiltersynproxy module. The flaw stems from unaligned memory access during TCP timestamp adjustment operations. The kernel reads and writes timestamp fields without using alignment-safe accessors, which can degrade performance on most architectures and trigger a crash on strict alignment architectures. The fix replaces direct field access with get_unaligned_be32() and put_unaligned_be32() helpers, mirroring the approach already used by tcp_parse_options() and synproxy_parse_options() in the networking stack.
Critical Impact
Remote attackers can trigger kernel instability or crashes on strict-alignment architectures by sending crafted TCP traffic through hosts using synproxy, resulting in denial of service.
Affected Products
- Linux kernel with netfiltersynproxy enabled
- Systems running strict alignment CPU architectures (for example, certain ARM, MIPS, SPARC variants)
- Distributions shipping kernels prior to the fix commits referenced in the stable tree
Discovery Timeline
- 2026-08-28 - CVE-2026-80637 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80637
Vulnerability Analysis
The defect lives in the netfiltersynproxy code path that rewrites TCP timestamp option fields during SYN cookie handling. The original implementation dereferences timestamp fields directly from the TCP option buffer. TCP options are byte-packed and are not guaranteed to fall on a 4-byte boundary within the packet. Direct 32-bit access to those bytes therefore produces unaligned loads and stores.
On x86 and other architectures that tolerate unaligned access, the operation succeeds but incurs a performance penalty. On strict-alignment architectures, the CPU raises an alignment fault, which the kernel translates into a bug or panic depending on configuration. Because synproxy processes attacker-controlled network traffic before connection state is established, the fault can be triggered remotely without authentication.
Root Cause
The root cause is missing use of alignment-safe accessors when reading and writing multi-byte TCP option fields. The rest of the networking stack already handles this correctly in tcp_parse_options() and synproxy_parse_options(). The vulnerable synproxy timestamp adjustment path was inconsistent with that convention and dereferenced pointers into the option area as __be32 values.
Attack Vector
Exploitation requires sending TCP traffic that reaches a host acting as a synproxy target. No authentication or user interaction is needed. On strict alignment systems, a single crafted TCP handshake sequence can crash the kernel. The vulnerability affects availability only; confidentiality and integrity are not impacted.
See the upstream stable fixes: commit 2b8e7aaa, commit 5c9c67cf, commit 992c20bc, and commit ea3d2caa.
Detection Methods for CVE-2026-80637
Indicators of Compromise
- Kernel Oops or panic messages referencing synproxy_send_client_synack, synproxy_send_server_ack, or synproxy_tstamp_adjust in dmesg or journalctl -k output.
- Alignment fault traces (Alignment trap on ARM, Unaligned access on other architectures) originating in netfilter code.
- Unexpected reboots or watchdog resets on hosts configured with SYNPROXY iptables or nftables targets during traffic bursts.
Detection Strategies
- Audit iptables-save, nft list ruleset, and firewall configuration management to identify hosts using SYNPROXY targets.
- Correlate kernel crash telemetry with network flows to hosts running vulnerable kernels, using centralized log aggregation.
- Track running kernel versions against distribution advisories for the referenced stable-tree fix commits.
Monitoring Recommendations
- Forward kernel logs to a centralized store and alert on synproxy-related backtraces.
- Monitor host availability and TCP handshake failure rates for anomalies on synproxy front-ends.
- Track kernel package versions across the fleet and flag hosts running builds without the fix.
How to Mitigate CVE-2026-80637
Immediate Actions Required
- Inventory Linux hosts that enable netfiltersynproxy, particularly those on ARM, MIPS, or SPARC-class hardware.
- Apply the vendor-supplied kernel update that includes the upstream fixes referenced in the stable-tree commits.
- Reboot patched systems to activate the corrected kernel image.
Patch Information
The fix is available in the mainline and stable Linux kernel trees through the following commits: 2b8e7aaa, 5c9c67cf, 992c20bc, and ea3d2caa. Consume the fix through your distribution's kernel package channel.
Workarounds
- Remove SYNPROXY iptables and nftables rules on affected hosts until a patched kernel is deployed.
- Terminate SYN flood protection at an upstream device that is not running a vulnerable kernel.
- Rate-limit inbound TCP SYN traffic at the network edge to reduce exposure while patching is in progress.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
