CVE-2026-80744: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80744 is a denial-of-service vulnerability in the Linux kernel's netfilter nf_tables_offload module, where WARN_ON_ONCE(err) is incorrectly triggered during transaction rollback for expected memory allocation failures (-ENOMEM). This causes spurious kernel warnings under low-memory conditions that do not represent actual kernel bugs. The vulnerability affects Linux kernel versions from 5.5 onward, with fixed versions available at 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. It was published on September 3, 2026, and discovered by the Linux Verification Center (linuxtesting.org) using Syzkaller. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.226% (Github Advisory).

The root cause is improper error handling in nft_flow_rule_offload_abort() within net/netfilter/nf_tables_offload.c, where WARN_ON_ONCE(err) fires on any non-zero error code during rollback — including the expected -ENOMEM return from flow_block_cb_alloc(). The call chain involved is: nft_flow_offload_chain() → nft_flow_block_chain() → nft_chain_offload_cmd() → nft_block_offload_cmd() → ndo_setup_tc() → flow_block_cb_setup_simple() → flow_block_cb_alloc(), which can fail with -ENOMEM under memory pressure. The fix changes the condition to WARN_ON_ONCE(err && err != -ENOMEM), aligning with standard kernel practice of not warning on memory allocation failures. No CWE classification has been formally assigned (Github Advisory).

The primary impact is availability degradation: local users can trigger spurious WARN_ON_ONCE kernel warnings by inducing memory pressure or using fault injection during nf_tables transaction processing, polluting system logs and potentially triggering automated responses to kernel warnings (e.g., panic-on-warn configurations). There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution. The scope is limited to the local system running an affected Linux kernel version with netfilter offload functionality enabled (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access to trigger memory pressure conditions or use fault injection tooling. The EPSS score is 0.226% (14th percentile), indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory).

• Logs: Kernel log entries containing WARNING: CPU: <N> PID: <N> at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort or nft_flow_rule_offload_commit+0x971/0xcd0; repeated WARN_ON_ONCE splats in dmesg or /var/log/kern.log during nf_tables transaction processing under memory pressure.
• Process: Processes such as syz-executor or other netlink-sending processes (e.g., nft, custom scripts) repeatedly submitting nf_tables batch transactions that trigger rollback paths.

Apply the upstream kernel patch that changes WARN_ON_ONCE(err) to WARN_ON_ONCE(err && err != -ENOMEM) in nft_flow_rule_offload_abort(). Fixed kernel versions are: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2 (mainline). Patches are available via the stable kernel git tree at multiple commit references. As a short-term workaround, disabling netfilter hardware offload (nft_flow_offload) if not required can prevent the vulnerable code path from being reached (Github Advisory).