Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-28T00:00:00 kernel: netfilter: conntrack: revert ct extension genid infrastructure 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-476

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 ("netfilter: extensions: introduce extension genid count") this patch disables all ct extensions (leading to NULL) for unconfirmed conntracks, when this is only targeted at ct helper and ct timeout. There is also codebase that dereferences the ct extension without checking for NULL which could lead to crash.

A flaw was found in the Netfilter conntrack component of the Linux kernel. This vulnerability arises from the improper handling of connection tracking (conntrack) extensions. Specifically, a codebase change that disables all conntrack extensions for unconfirmed conntracks, without proper null checks, can lead to a system crash. This could allow a local attacker to cause a Denial of Service (DoS).

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-80636 https://nvd.nist.gov/vuln/detail/CVE-2026-80636 https://lore.kernel.org/linux-cve-announce/2026082840-CVE-2026-80636-32e4@gregkh/T