Skip to main content

Linux Kernel EUVDEUVD-2026-67544

| CVE-2026-80668 CRITICAL
2026-08-28 Linux GHSA-fpgw-998r-pg47
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach host running conntrack helper
  2. Delivery
    Send traffic creating related expectations
  3. Exploit
    Race expectation removal vs expiring timer
  4. Execution
    Trigger stale exp->master use-after-free
  5. Impact
    Corrupt kernel memory / DoS or escalate

Vulnerability Assessment

Exploitation Conditions

Requires the netfilter connection-tracking expectation path to be active - i.e. a conntrack helper (FTP/SIP/PPTP, etc.) loaded or an nft_ct 'ct expectation' rule in use - since the bug lives in nf_conntrack_expect timer/removal handling. Exploitation further requires winning a race between expectation removal (including error paths via nf_conntrack_unexpect_related) and an expiring expectation timer where timer_del() reports false, so it is timing-dependent and non-deterministic. Systems that do not use conntrack helpers/expectations are not exposed via this path. The provided CVSS PR:N/AC:L is not reliable here: the flaw is a config-dependent kernel race, not a guaranteed unauthenticated single-shot exploit.
Impact

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) substantially overstates real-world risk for a kernel-internal race condition and conflicts with the other signals. EPSS is only 0.15% (5th percentile), it is not in CISA KEV, and no POC is referenced - all pointing to low near-term exploitation likelihood. The description makes clear exploitation depends on a narrow timing window between expectation removal and an expiring timer, and only manifests when connection-tracking helpers/expectations are actually configured, which contradicts the AC:L/PR:N assumption; winning a kernel race reliably is materially harder than 'low complexity.' This is a defense-in-depth hardening fix that most operators can patch on their normal stable-kernel cadence rather than as an emergency, though internet-facing firewalls/NAT gateways running conntrack helpers should prioritize it higher than the EPSS alone suggests. Net: real but not urgent for typical deployments - verify whether conntrack expectation helpers are in use before deciding priority.
Exploit ScenarioDerived

On a NAT/firewall host with conntrack helpers enabled, an attacker drives traffic that rapidly creates and tears down expected (related) connections, then races expectation removal against the expiring per-expectation timer so that an expectation dereferences an already-freed master conntrack. Winning this narrow window could corrupt kernel memory, potentially yielding denial of service or, in a best case for the attacker, code execution/privilege escalation. No public exploit or POC is referenced, and reliable exploitation would require precise timing control.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Use-after-free / stale-pointer race in the Linux kernel netfilter nf_conntrack_expect subsystem was resolved by replacing the per-expectation timer API with the conntrack garbage-collection worker. Under the old timer scheme, expectation removal could lose a race with an expiring timer (timer_del() returning false), leaving an expectation referencing an already-released exp->master conntrack, enabling stale-pointer access. The issue affects systems using connection-tracking helpers/expectations (e.g. FTP, SIP, or nft_ct expectations); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.15% (5th percentile).

RemediationAI

Upstream fix available (commit); the corresponding stable releases are the patched versions - upgrade to at least Linux 6.1.176, 6.6.143, 6.12.94, 6.18.24, or 6.19.14 (or later on your branch) depending on which series you run, or apply your distribution's kernel update that backports commits 7ec786f4230c and b8b09dc2bf35. If you cannot patch immediately, a targeted compensating control is to avoid loading/using connection-tracking helper modules and nft_ct expectation rules (e.g. do not load nf_conntrack_ftp/sip/pptp and remove 'ct helper'/'ct expectation' nftables statements), since the race is reachable only through the expectation path; the trade-off is that protocols relying on those helpers (active-mode FTP, SIP/VoIP through NAT, PPTP) may break, so validate application impact first. Reference the fix commits at git.kernel.org (links above) to confirm the change is present in your build.

Affected VersionsENISA

Linux patch: 0
Linux bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 <b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2
Linux patch: 7.2
Linux 497f99b26fffdc5635706d1b4811f1ed8ee21a5b
Linux patch: 7.1.5
Linux 6.19.14 <6.20
Linux bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 <7ec786f4230c2a9b2eaf97a2d45368933b49d2b2
Linux 6.12.94 <6.13
Linux 6.6.143 <6.7
Linux 6.18.24 <6.19
Linux d52fa1fa7440676b8c238037a050ab008c22737f
Linux 7.0
Linux f338ced0473849c9f6ed0b77ca99f1aab5826787
Linux 5e1c1d22268ae710c238342c8030c21daf298168
Linux 9e1196d27ef496f404c76f7a9d03761142d991c4
Linux 6.1.176 <6.2

Affected Packages

euvd linux fix: 6.2, 6.7, 6.13, 6.19, 6.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is netfilter connection tracking (nf_conntrack), specifically the expectation subsystem (nf_conntrack_expect) that manages 'expected' related connections created by conntrack helpers such as FTP/SIP/PPTP and by nft_ct expectation rules. Each expectation previously held its own timer plus an extra conntrack refcount; the fix moves reaping to the existing conntrack GC worker, gates GC on IPS_HELPER_BIT, holds the expectation spinlock while walking the master's expectation list to synchronize with nf_ct_remove_expectations(), and adds NF_CT_EXPECT_DEAD to reap expectations invalidated in error paths (nf_conntrack_unexpect_related). The root cause is a time-of-check/time-of-use style race leading to access of a freed master pointer (use-after-free class, CWE-416 / CWE-362 family), even though the feed lists CWE as N/A.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.7 HIGH

Reachable via network traffic through conntrack helpers so AV:N/PR:N, but it is a timing race requiring non-default helper config, hence AC:H; primary impact is memory corruption (I/A:H) with limited direct disclosure (C:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 29, 2026 - 07:22 NVD
9.8 (CRITICAL)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:49 cve.org
CRITICAL 9.8
CVE Published
Aug 28, 2026 - 06:49 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.

Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available.

This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes.

This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false.

Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy.

Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.

Executive ViewAI

Why It Matters

A critical flaw in Linux kernel connection tracking-used for stateful firewalls and protocol-specific routing-could enable privilege escalation or denial of service on affected systems. No public exploits have been identified at this time, allowing organizations to plan remediation deliberately.

Business Impact: High
Compensating Controls

Patch available per vendor advisory

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel netfilter runs on nearly all Linux firewalls/servers
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80668 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/396609 REF https://git.kernel.org/stable/c/02f7809a19fc88cfd9bc113a4bfe7add6305db39 REF https://git.kernel.org/stable/c/3d7b808ec35291ee75dcdb2b6fe5f587bfe9b1df REF https://git.kernel.org/stable/c/61ca26e1a45965590f7e477c4d6f711162642e1c REF https://git.kernel.org/stable/c/7ec786f4230c2a9b2eaf97a2d45368933b49d2b2 REF https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2 REF https://git.kernel.org/stable/c/bc6b1da681abe631ed21b7fdced48546189d64a4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy