What is the CVSS score of CVE-2026-80603?

CVE-2026-80603 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-80603?

Within 24 hours, identify and document all Linux systems in your environment with the nf_conntrack_irc kernel helper enabled to establish the scope of affected assets. Within 7 days, obtain the vendor-released patch from your Linux distribution, test it thoroughly in a non-production staging environment to verify compatibility and performance, and begin staged deployment to production systems starting with less critical infrastructure to validate stability. Within 30 days, complete kernel updates on all affected systems, verify patch installation across your fleet through automated compliance scanning, and confirm that all systems are running patched kernel versions.

Linux Kernel CVE-2026-80603

Q: Which versions of Linux Kernel are affected by CVE-2026-80603?

A critical out-of-bounds read vulnerability in the Linux kernel's IRC connection-tracking helper (CVE-2026-80603, CVSS 9.1) could corrupt connection state information on affected systems, potentially…. A patch is available.

EUVD-2026-67479 CRITICAL

2026-08-28 Linux

GHSA-66q8-v4rr-393c

Buffer Overflow Linux

Critical

Disputed · 9.1 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Route IRC traffic through conntrack-IRC host
Delivery

Send DCC line without trailing newline
Exploit

Trigger off-by-one read at buffer end
Execution

simple_strtoul consumes stale digit byte
Impact

Corrupted DCC IP/port in conntrack expectation

Vulnerability Assessment

Exploitation Conditions	Requires the nf_conntrack_irc connection-tracking helper to be loaded and actively parsing IRC traffic traversing the host (typically a Linux firewall/router/NAT gateway) - on systems without this helper the vulnerable code path is never reached. The attacker must also get an IRC DCC message into that path with no newline within the inspected window so the loop reaches the exclusive-end byte. Exploitation is further limited because the out-of-bounds byte is never returned to the attacker (no information disclosure), the read cannot currently fault due to the MAX_SEARCH_SIZE+1 over-allocation and the datalen cap, and the only observable effect is a possibly-wrong DCC IP/port when the adjacent stale byte is an ASCII digit - an inherently probabilistic, low-value outcome.
Impact	The signals conflict sharply and should be reconciled before prioritization. The supplied CVSS is 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but the description itself states the read cannot fault (guarded by the +1 allocation and the datalen cap) and that the worst realistic consequence is a wrong DCC IP/port in a conntrack expectation - no attacker-visible memory disclosure, no write, no code execution, and no availability loss. That C:H/I:H rating is not supported by the described behavior and appears substantially inflated; this reads as a robustness/hardening fix for a fragile guard rather than an exploitable memory-corruption primitive. Corroborating this, EPSS is 0.18% (7th percentile), the CVE is not in CISA KEV, and no POC is known. No SSVC decision or CWE is provided in the input. Net assessment: low real-world priority despite the high nominal CVSS - patch in the normal kernel-update cycle, not as an emergency. Key caveat: it only matters where the nf_conntrack_irc helper is loaded and actively tracking IRC flows, which is uncommon in modern default deployments.
Exploit ScenarioDerived	An attacker sends IRC traffic through a Linux router/firewall that has the nf_conntrack_irc helper loaded, crafting a DCC control line with no terminating newline so parse_dcc() reads one byte past the copied buffer. If that stale byte happens to be an ASCII digit, the parsed DCC IP or port is corrupted, potentially opening a conntrack expectation for an unintended address/port. No POC is known and the read neither discloses memory to the attacker nor crashes the host.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build for your branch - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2 (or later) - via your distribution's kernel package, referencing the stable commits at git.kernel.org such as https://git.kernel.org/stable/c/abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-80603. If you cannot patch immediately, a targeted compensating control is to unload and blacklist the IRC connection-tracking helper (rmmod nf_conntrack_irc and blacklist it in modprobe.d, or avoid loading it via the nf_conntrack_helper setting); the trade-off is that automatic conntrack/NAT handling of IRC DCC transfers will break, so any firewall relying on the IRC helper to permit DCC flows must switch to explicit rules. Given the minimal real impact (a possible wrong DCC IP/port, no fault) this workaround is only warranted where the helper is in use and patching is delayed.

Affected VersionsENISA

Linux 2.6.12

Linux patch: 5.10.261

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2393f0bd7a467ad475598f3a5b9de27ca36e3037

Linux patch: 0

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2b70f61f569bb29acb380e6f616a1bbdee15668f

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <eeef3b81f449560653662df2dde6f6fe247c5365

Linux patch: 6.12.97

Linux patch: 6.6.145

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <aff589556ed772cb1c0c2d7b4d91ec45c0c39416

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e

Linux patch: 6.18.40

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a

Linux patch: 5.15.212

Linux patch: 7.2

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <437e0a3854b3a44ec15afa9ab88ec215adf3a2fd

Linux patch: 6.1.178

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1

Linux patch: 7.1.5

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected code is nf_conntrack_irc, the Linux netfilter connection-tracking helper that inspects plaintext IRC control traffic to open expectations for out-of-band DCC (Direct Client-to-Client) transfers. parse_dcc() scans an skb payload copied via skb_header_pointer() into a kmalloc'd irc_buffer of MAX_SEARCH_SIZE + 1 bytes, searching for a newline with a loop that runs while tmp <= data_end. Because the sole caller supplies data_limit = ib_ptr + datalen (one past the last valid byte) but the function treats it as inclusive, the loop dereferences *tmp at the exclusive-end position when no newline is present - an off-by-one out-of-bounds read (CWE-193 / CWE-125; the CVE record lists CWE as N/A and the feed tags it loosely as 'Buffer Overflow', though it is strictly an OOB read, not a write). If the stray stale/uninitialized byte is an ASCII digit, simple_strtoul consumes it and corrupts the parsed DCC IP/port value used to build the conntrack expectation.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 3.7 LOW

Reached only when the nf_conntrack_irc helper is active and no newline is present, so AC:H; no data is disclosed to the attacker (C:N), at worst a corrupted conntrack expectation (I:L), no crash (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE CRITICAL

Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 29, 2026 - 07:22 NVD

9.1 (CRITICAL)

Patch available

Aug 28, 2026 - 09:02 EUVD

CVE Published

Aug 28, 2026 - 06:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 06:48 cve.org

CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte.

The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer().

irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read.

Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.

Executive ViewAI

Why It Matters

A critical out-of-bounds read vulnerability in the Linux kernel's IRC connection-tracking helper (CVE-2026-80603, CVSS 9.1) could corrupt connection state information on affected systems, potentially disrupting network traffic handling for systems using IRC protocols. This vulnerability affects only Linux systems with the nf_conntrack_irc kernel helper explicitly enabled, and no public exploit has been identified at time of analysis. Patch is available from vendors, enabling organizations to reduce this technical risk through standard kernel update procedures.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Ubiquitous

Linux kernel netfilter code present across nearly all Linux deployments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back