VulnerabilityPublished 4 Sep 2026Updated 30 Oct 2026

CVE-2026-80837: Linux kernel · netfilter: nf_tables: don't queue packet path object notifications

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f010756ed75ac003146a1cbc93501092343bb3a3 : patch Linux kernel soon.

Data as of 30 Oct 2026, 13:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f010756ed75ac003146a1cbc93501092343bb3a3, e97e2d6d0b150fd78be573f9fdf193f204d9334e, df86c0e84025be8b6dd572a20852698927aa666b +4

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < f010756ed75ac003146a1cbc93501092343bb3a3	Fixed in f010756ed75ac003146a1cbc93501092343bb3a3
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < e97e2d6d0b150fd78be573f9fdf193f204d9334e	Fixed in e97e2d6d0b150fd78be573f9fdf193f204d9334e
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < df86c0e84025be8b6dd572a20852698927aa666b	Fixed in df86c0e84025be8b6dd572a20852698927aa666b
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < 7904b94768e983bcb2be34a8d6d1f3450f5b838b	Fixed in 7904b94768e983bcb2be34a8d6d1f3450f5b838b
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < 6989f298103f575a768a85e4b19d2384709237f8	Fixed in 6989f298103f575a768a85e4b19d2384709237f8
LinuxLinux	Affected ≥ 67cc570edaa02016a8685a06a0ee91f05a6277d9, < 68de7f3a38acab355c24114f77bf00d3094ce4da	Fixed in 68de7f3a38acab355c24114f77bf00d3094ce4da

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits. Users and administrators should update to a Linux kernel version that includes these fixes to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.

Description

CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem related to queuing packet path object notifications. The flaw arises because notifications are queued without proper locking, causing a race condition between list addition and deletion that can lead to use-after-free errors. This occurs when packets traverse a chain referencing a depleted quota object, potentially causing kernel memory corruption. The issue has been fixed in several Linux kernel commits.

Impact

The vulnerability can cause a kernel use-after-free condition, leading to memory corruption and potential kernel crashes or instability. While no public exploits or in-the-wild exploitation are known, successful exploitation could impact system stability and security by corrupting kernel memory.

Summary

This vulnerability in the Linux kernel's netfilter nf_tables subsystem involves improper queuing of packet path object notifications. The function nft_obj_notify(), called from the packet path, queues notifications onto a notify_list without proper locking, leading to a race condition between list_add_tail() and list_del() + kfree_skb() on different CPUs. This race can cause a use-after-free error detected by KASAN, as the kernel attempts to write through a freed sk_buff structure. The root cause is that notify_list is only drained during netlink transactions protected by commit_mutex, but notifications from the packet path are queued without this protection. The fix restores immediate sending of notifications from the packet path and retains queuing only for notifications within transactions, eliminating the race condition.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:18 UTC

Technical details

References

Community reviews

Related threats