netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already release
CVE-2026-80668
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80668
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5e1c1d22268ae710c238342c8030c21daf298168",
"lessThan": "3d7b808ec35291ee75dcdb2b6fe5f587bfe9b1df",
"versionType": "git"
},
{
"status": "affected",
"version": "d52fa1fa7440676b8c238037a050ab008c22737f",
"lessThan": "02f7809a19fc88cfd9bc113a4bfe7add6305db39",
"versionType": "git"
},
{
"status": "affected",
"version": "bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5",
"lessThan": "7ec786f4230c2a9b2eaf97a2d45368933b49d2b2",
"versionType": "git"
},
{
"status": "affected",
"version": "bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5",
"lessThan": "b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2",
"versionType": "git"
},
{
"status": "affected",
"version": "9e1196d27ef496f404c76f7a9d03761142d991c4",
"versionType": "git"
},
{
"status": "affected",
"version": "f338ced0473849c9f6ed0b77ca99f1aab5826787",
"versionType": "git"
},
{
"status": "affected",
"version": "497f99b26fffdc5635706d1b4811f1ed8ee21a5b",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.143",
"lessThan": "6.6.160",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.94",
"lessThan": "6.12.114",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.176",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.24",
"lessThan": "6.19",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.19.14",
"lessThan": "6.20",
"versionType": "semver"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack_expect.h",
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_h323_main.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nft_ct.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack_expect.h",
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_h323_main.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nft_ct.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80668
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #46624 · Revision 1
- Added to Heist Feed
- Publisher date