CVE-2026-80668 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.
Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available.
This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes.
This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false.
Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy.
Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel vulnerability addressed involves a race condition and resource management inefficiency within the netfilter connection tracking subsystem, specifically concerning how expired expectations are reaped from memory. The core technical flaw stems from the previous implementation's reliance on individual timer APIs for managing the lifecycle of conntrack expectations. This approach created scenarios where an expectation could access a stale master pointer because the removal process raced with an expiring timer that failed to delete itself in time, leading nf_ct_remove_expectations() and the timer callback into conflicting states regarding memory ownership. By replacing these discrete timers with a centralized garbage collection worker mechanism aligned with existing conntrack subsystem practices, the kernel eliminates this race condition entirely. The new approach iterates over local lists of expectations within the master connection tracking entry using spinlocks to ensure synchronization during removal operations, thereby preventing use-after-free errors and ensuring that memory is reclaimed safely without leaving dangling pointers or orphaned structures in global hash tables.
From an operational impact perspective, this change significantly enhances system stability and security by removing a class of potential kernel panics or information leaks caused by accessing freed memory through stale references. The refactoring also improves performance and reduces overhead by eliminating unnecessary reference count bumps associated with expectation timers. Previously, each timer manipulation required incrementing connection tracking object counts, which added latency to packet processing paths. With the new garbage collection worker approach, runtime packet path garbage collection occurs during insertion and lookup operations across global expectation hash table chains. Unconfirmed entries are skipped because their extensions might be reallocated, while dying entries are bypassed as they will naturally disappear soon. This optimization ensures that only valid, active expectations consume resources, reducing memory pressure on systems with high connection rates or complex network policies involving many concurrent connections and associated expectations such as FTP or SIP protocol helpers.
The technical implementation introduces the NF_CT_EXPECT_DEAD flag to handle error paths where newly created expectations must be invalidated but cannot be immediately released due to potential races between garbage collection workers and removal functions. This mechanism ensures that even if an expectation fails validation after being added to hashes, it is marked for deferred reclamation rather than immediate deletion which could corrupt data structures. Additionally, the patch standardizes timestamp handling by setting current time during allocation and calculating lifetime based on policy timeouts or custom values specified at creation. Security-wise, this aligns with CWE-416 (Use After Free) mitigation strategies by ensuring that object lifecycles are managed through a single authoritative garbage collection process rather than distributed timer callbacks. It also relates to ATT&CK technique T1059 (Command and Scripting Interpreter) indirectly by hardening the kernel against exploitation vectors that might leverage race conditions in network stack components for privilege escalation or denial of service attacks targeting critical infrastructure services relying on netfilter rulesets.
Mitigation strategies primarily involve applying this upstream Linux kernel patch to affected distributions, as it addresses a fundamental architectural weakness rather than a simple configuration error. Administrators should ensure their systems are updated with the latest stable kernel versions that include conntrack garbage collection improvements for expectations. For environments unable to update immediately, monitoring connection tracking tables for abnormal growth or high numbers of unconfirmed entries may indicate stress on the old timer-based system, though no direct workaround exists other than upgrading. The fix represents a best practice in systems programming by consolidating lifecycle management into a single worker thread pattern, which is widely recognized as more robust and less prone to concurrency bugs compared to per-object timer mechanisms. This change reinforces the integrity of network packet filtering operations and supports compliance with security standards requiring resilient kernel subsystems capable of handling high-throughput traffic without resource exhaustion or memory corruption vulnerabilities.