In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte. The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer(). irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read. Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusi
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80603 is a critical off-by-one buffer over-read vulnerability in the Linux kernel's netfilter IRC connection tracking module, specifically in the parse_dcc() function. This vulnerability allows an attacker to read one byte beyond the allocated buffer boundary when parsing malformed IRC protocol messages that lack proper newline terminators. The flaw affects any Linux system running a vulnerable kernel version with netfilter enabled, particularly those processing IRC traffic or acting as firewalls/routers inspecting IRC connections. While the immediate impact is information disclosure through out-of-bounds memory reads, the CVSS 9.1 critical rating reflects the potential for kernel memory leakage and possible exploitation chains leading to privilege escalation.
Although this CVE currently maps to zero MITRE ATT&CK techniques and lacks CWE classification in public records, Casky's Claude-powered analysis would identify this as a memory safety issue exhibiting characteristics of reconnaissance and privilege escalation attack patterns. Practitioners using Casky would observe findings related to kernel exploit development (T1548.004 - Abuse Elevation Control Mechanism), memory disclosure vulnerabilities used for ASLR bypass, and potential command execution paths. The platform's 754 mapped security skills would flag this during source code analysis, kernel patch assessment, and threat hunting for IRC-based attack vectors, enabling security teams to prioritize kernel updates and implement network-level IRC traffic filtering before adversaries weaponize this disclosure primitive.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80603. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation