Executive brief
The Linux kernel's netfilter module includes a parser for IRC protocol DCC commands that contains an off-by-one buffer read error. An attacker sending specially crafted IRC DCC traffic can cause the kernel to read uninitialized memory one byte beyond a buffer boundary, potentially corrupting connection tracking data (such as IP addresses and ports) used by the firewall to manage network sessions. This could lead to network traffic being misrouted, connection state corruption, or unexpected kernel behavior on systems using netfilter for connection tracking.
Technical details
The vulnerability is an off-by-one boundary condition in the parse_dcc() function in net/netfilter/nf_conntrack_irc.c. The function treats data_end as an inclusive endpoint while its caller passes an exclusive endpoint (one byte past the last valid data). The newline search loop iterates with tmp <= data_end, causing a read at data_end when no newline is found, accessing one byte beyond the allocated region. While currently protected by an extra allocation byte (MAX_SEARCH_SIZE + 1), uninitialized or stale memory could contain ASCII digits that simple_strtoul() parses, resulting in incorrect DCC IP or port values in the connection expectation. The fix changes loop conditions to use strict less-than comparisons, making the function consistent with the caller's exclusive-end convention. No authentication or special preconditions are required; the vulnerability is triggered by receipt of IRC DCC traffic on the network.
Affected products
- Linux Linux kernel 2.6.12 and later (exact range determined by netfilter nf_conntrack_irc module presence)
Timeline
- 2026-08-28: disclosed: CVE-2026-80603 published
- 2026-07-24: patched: Fix included in stable kernel branches
- 2026-05-19: other: Original fix commit by Muhammad Bilal