CVE-2026-80636

A flaw was found in the Netfilter conntrack component of the Linux kernel. This vulnerability arises from the improper handling of connection tracking (conntrack) extensions. Specifically, a codebase change that disables all conntrack extensions for unconfirmed conntracks, without proper null checks, can lead to a system crash. This could allow a local attacker to cause a Denial of Service (DoS).

The conntrack extension genid logic could make nf_ct_ext_find return NULL for unconfirmed conntrack entries even when later code expected a valid extension and dereferenced it. This can lead to a NULL pointer dereference in netfilter conntrack processing and crash the kernel. For the CVSS the PR:L is used in the paranoid score because CAP_NET_ADMIN or equivalent netfilter control may be delegated to a container root, service account, or reduced capability administrator in some deployments. The issue is not clearly exploitable by remote packets alone because reliable triggering appears to require control plane changes affecting conntrack extensions, helpers, or timeouts. Impact is denial of service via kernel crash. No concrete UAF, OOB write, arbitrary write, or information leak primitive is proven by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.