Executive brief
The Linux kernel's netfilter connection tracking system contains a race condition in expectation handling that can lead to use-after-free memory access. An attacker with network access can trigger this vulnerability to cause kernel crashes or potentially execute arbitrary code, affecting any system running a vulnerable kernel version.
Technical details
The vulnerability exists in the Linux kernel's netfilter connection tracking (nf_conntrack_expect) subsystem, where a race condition between expectation removal and timer expiration can result in access to a stale exp->master pointer. The issue arises when timer_del() reports false during expectation removal while an expiring timer is concurrently executing. The patch replaces the timer-based API with a garbage collection worker approach, introduces proper spinlock synchronization when iterating over master conntrack expectation lists, and adds the NF_CT_EXPECT_DEAD flag to safely reap expectations via GC. The vulnerability is exploitable via network-accessible netfilter operations.
Affected products
- Linux Linux kernel affected versions prior to the patch resolution
Timeline
- 2026-08-28: disclosed: CVE-2026-80668 published
- patched: Patch addresses race condition by replacing timer API with GC worker approach