CVE-2026-80668 Overview
CVE-2026-80668 is a vulnerability in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_expect component. The flaw involves a race condition between the expectation timer API and expectation removal logic. When timer_del() returns false during an expiring timer, an expectation can access a stale exp->master pointer that has already been released. The upstream fix replaces the timer API with a garbage collection (GC) worker approach and introduces a new NF_CT_EXPECT_DEAD flag to reap invalidated expectations safely.
Critical Impact
A network-reachable race condition in connection tracking expectations can lead to use-after-free access of released memory, enabling potential memory corruption in the kernel.
Affected Products
- Linux kernel netfilter subsystem (nf_conntrack_expect)
- Distributions shipping vulnerable pre-patch kernel versions
- Systems using nft_ct expectation policies or conntrack helpers
Discovery Timeline
- 2026-08-28 - CVE-2026-80668 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80668
Vulnerability Analysis
The vulnerability resides in how the nf_conntrack_expect subsystem manages the lifetime of expectation entries. Expectations track anticipated related connections created by conntrack helpers such as FTP or SIP. The legacy implementation relied on the kernel timer API to expire and free these expectations.
When expectation removal races with an expiring timer, timer_del() can return false. The removal path then proceeds under the assumption that the timer callback will not run, while the callback is already executing. This creates a window in which the timer callback dereferences exp->master, a conntrack pointer that has already been released by the parallel removal path.
The fix refactors expectation reaping to use the existing conntrack GC worker. It iterates the master conntrack's expectation list under the expectation spinlock, synchronizing with nf_ct_remove_expectations(). The IPS_HELPER_BIT is set when the helper conntrack extension is added, letting the GC worker check helper availability without bumping the refcount.
Root Cause
The root cause is a race condition (TOCTOU-style) between the timer expiration path and the explicit expectation removal path in nf_conntrack_expect. Because both paths can access exp->master concurrently without adequate synchronization, one path can free the underlying conntrack while the other is still holding a stale pointer, resulting in a use-after-free condition.
Attack Vector
Exploitation requires generating network traffic that induces expectation creation and rapid teardown through a conntrack helper. Error paths in nf_conntrack_unexpect_related() are particularly relevant, as they invalidate newly created expectations already inserted into the global hashes. An attacker who can trigger expectation churn against a helper-enabled flow may race the timer and removal paths to reach the stale-pointer state.
No verified public exploit code is available for CVE-2026-80668. For technical details, see the upstream commit 7ec786f4 and the follow-up commit b8b09dc2.
Detection Methods for CVE-2026-80668
Indicators of Compromise
- Kernel oops or panic messages referencing nf_conntrack_expect, nf_ct_remove_expectations, or expectation timer callbacks.
- Sporadic KASAN use-after-free reports involving exp->master in netfilter code paths on kernels with KASAN enabled.
- Unexpected conntrack helper activity or expectation churn from a single source generating repeated related-connection setups.
Detection Strategies
- Monitor kernel logs for netfilter-related crashes, warnings, or slab corruption traces on hosts running vulnerable kernel versions.
- Compare running kernel versions against distribution advisories referencing the upstream commits.
- Baseline conntrack helper usage and alert on anomalous rates of expectation creation and removal.
Monitoring Recommendations
- Forward kernel ring buffer output and dmesg events to a centralized logging platform for anomaly detection.
- Track host reboots and kernel crash dump generation on servers exposing helper-processed protocols such as FTP or SIP.
- Correlate network flow telemetry with conntrack table churn to identify sessions attempting to race expectation lifecycles.
How to Mitigate CVE-2026-80668
Immediate Actions Required
- Inventory Linux hosts running kernels that predate the fix commits and prioritize patching internet-exposed systems with active conntrack helpers.
- Apply distribution-provided kernel updates that incorporate the upstream netfilter fix as soon as they become available.
- Where patching is not immediately possible, restrict inbound traffic to services that trigger conntrack helper-based expectation creation.
Patch Information
The fix is delivered by two upstream commits: 7ec786f4230c2a9b2eaf97a2d45368933b49d2b2 and b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2. The patches replace the expectation timer API with the conntrack GC worker, introduce the NF_CT_EXPECT_DEAD flag, and adjust IPS_HELPER_BIT handling. Rebuild or install kernel packages that include both commits.
Workarounds
- Disable or unload conntrack helper modules (for example, nf_conntrack_ftp, nf_conntrack_sip) that are not required by workloads.
- Remove nft_ct expectation policies until a patched kernel is deployed if their use is not operationally necessary.
- Apply network segmentation and firewall rules that restrict which sources can reach services depending on helper-based expectations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
