CVE-2026-80603

A flaw was found in the Linux kernel's netfilter component, specifically within the nf_conntrack_irc module. An off-by-one error in the parse_dcc() function can cause the system to read one byte beyond an allocated buffer. This can lead to the use of uninitialized or stale data, potentially resulting in an incorrect IP address or port being recorded in the connection tracking (conntrack) expectation for Direct Client-to-Client (DCC) connections. This could disrupt network communication or lead to incorrect routing.

An off by one read in nf_conntrack_irc parse_dcc happens because data_end is passed as one past the last valid byte but the parser treated it as an inclusive end pointer. If an IRC DCC payload has no newline inside the copied region, the loop can read one byte past the skb_header_pointer() data and simple_strtoul may consume a stale or uninitialized digit. This can produce a wrong DCC IP or port in the conntrack expectation and may weaken filtering behavior when the IRC helper is enabled for inspected traffic. For the CVSS the PR:N because a remote sender does not need an account on the target when the helper is enabled and the crafted IRC traffic is inspected by the firewall or gateway. The issue is network reachable only in deployments that enable or assign nf_conntrack_irc to IRC traffic. Impact is mainly low integrity impact through incorrect expectation creation, with possible low confidentiality impact in the paranoid interpretation. There is no clear evidence of kernel memory corruption, arbitrary write, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.