CVE-2026-80668

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

This patch replaces the timer API by GC worker approach for

expectations, as it already happened in many other subsystems.

Use the existing conntrack GC worker to iterate over the local list of

expectations in the master conntrack to reap expired expectations.

Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct

expectation which nevers sets it. Hold the expectation spinlock while

iterating over the master conntrack expectation list to synchronize with

nf_ct_remove_expectations(). This also performs runtime packet path

garbage collection through the expectation insertion and lookup

functions while walking over one of the chains of the global expectation

hashtables. Unconfirmed conntrack entries are skipped since ct->ext can

be reallocated and dying are skipped since those will be gone soon.

Set on IPS_HELPER_BIT if the helper ct e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References