CVE-2026-80668

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the netfilter nf conntrack expect component. The issue occurs when expectation removal loses a race with an expiring timer, specifically when timer del() returns false, allowing an expectation to access a stale exp->master pointer that has already been released. To resolve this, the timer API is replaced with a Garbage Collection (GC) worker approach. This new mechanism uses the conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired entries. It introduces the NF CT EXPECT DEAD flag to invalidate newly created expectations in error paths via the nf conntrack unexpect related() function and ensures synchronization by holding the expectation spinlock during iteration to prevent conflicts with nf ct remove expectations().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.