Executive brief
The Linux kernel's netfilter connection tracking module contained faulty logic that could cause a system crash when code tried to access connection extension data without proper NULL checks. This affects firewalls, routers, and any systems using netfilter for network traffic filtering and management, potentially leading to denial of service if an attacker can trigger the affected code path.
Technical details
A previous patch introduced a "genid" (generation ID) infrastructure to track conntrack extension validity, but the implementation was overly broad and disabled extensions for all unconfirmed connections, not just the targeted helpers and timeout extensions. This caused code paths that dereference connection extensions without NULL checking to crash. The vulnerability is a NULL pointer dereference in the netfilter conntrack extension lookup logic. The issue affects unconfirmed network connections before they are inserted into the conntrack hash table. The fix reverts the problematic genid infrastructure (commit c56716c69ce1) to restore proper extension handling. Patches are available in kernel stable branches.
Affected products
- Linux Linux kernel Affected versions using commit c56716c69ce1 and later, prior to revert in stable branches
Timeline
- 2026-06-04: other: Fix commit created by Pablo Neira Ayuso
- 2026-08-28: advisory: CVE-2026-80636 published