Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80603— netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： netfilter: nf_conntrack_irc: 修复 parse_dcc() 中的差一错误导致的越界读取 问题描述： 函数将 视为包含式的结束指针，但其唯一的调用方传递的是 ，该指针指向最后一个有效字节的后一个字节位置。 换行符搜索循环使用条件 进行迭代。当数据中不存在换行符时，当 时，会读取 ，即读取了由 填充的区域之后的一个字节。 影响分析： 通过 分配了 字节，而 被限制在 以内，因此这个“越界”读取不会触发内存错误（因为多分配的一个字节起到了保护缓冲作用）

CVSS 9.1 · Critical EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1027 · Obfuscated Files or Information

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 437e0a3854b3a44ec15afa9ab88ec215adf3a2fd affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2b70f61f569bb29acb380e6f616a1bbdee15668f affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2393f0bd7a467ad475598f3a5b9de27ca36e3037 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< aff589556ed772cb1c0c2d7b4d91ec45c0c39416 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< eeef3b81f449560653662df2dde6f6fe247c5365 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80603

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte. The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer(). irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read. Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-80603

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80603

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80603 (8)

Same Patch Batch · Linux · 2026-08-28 · 135 CVEs total

CVE-2026-80634 9.8 CRITICAL netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CVE-2026-80694 9.8 CRITICAL net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CVE-2026-80681 9.8 CRITICAL vxlan: re-fetch eth header after route_shortcircuit()
CVE-2026-80674 9.8 CRITICAL ntfs: validate resident attribute lists and harden the validator
CVE-2026-80673 9.8 CRITICAL ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
CVE-2026-80668 9.8 CRITICAL netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CVE-2026-80630 9.8 CRITICAL net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin
CVE-2026-80617 9.8 CRITICAL net: airoha: fix foe_check_time allocation size
CVE-2026-80714 9.8 CRITICAL ipvs: do not propagate one-packet flag to synced conns
CVE-2026-80609 9.8 CRITICAL qede: fix out-of-bounds check for cqe->len_list[]
CVE-2026-80600 9.8 CRITICAL batman-adv: dat: acquire ARP hw source only after skb realloc
CVE-2026-80612 9.8 CRITICAL net: lwtunnel: Drop skb metadata before LWT encapsulation
CVE-2026-80671 9.3 CRITICAL perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80693 9.3 CRITICAL idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80684 9.3 CRITICAL KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CVE-2026-80670 9.1 CRITICAL perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
CVE-2026-80683 8.8 HIGH Bluetooth: SCO: give the socket its own sco_conn reference
CVE-2026-80604 8.8 HIGH HID: core: Fix OOB read in hid_get_report for numbered reports
CVE-2026-80692 8.8 HIGH Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
CVE-2026-80724 8.8 HIGH ptp: vmclock: prevent read-only mappings from becoming writable

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80603

No comments yet

Leave a comment