In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct e
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80668 addresses a critical vulnerability in the Linux kernel's netfilter subsystem, specifically in how connection tracking expectations are managed and garbage collected. The flaw stems from improper lifecycle management of expectation objects within the nf_conntrack_expect module, where the transition from timer-based to garbage collection-based reaping was incomplete. This vulnerability affects all Linux systems running vulnerable kernel versions that handle network connection tracking, particularly those relying on stateful firewall rules, NAT operations, or protocol-specific helpers (FTP, SIP, etc.). The CVSS 9.8 rating indicates near-universal exploitability with minimal attack complexity, making this a critical concern for infrastructure defenders managing Linux-based network security appliances, firewalls, and cloud environments.
While Casky's current skill library shows no direct mappings for this specific kernel subsystem vulnerability, practitioners leveraging Claude AI's extended reasoning capabilities would detect attack patterns related to resource exhaustion and denial of service techniques. Attackers exploiting this flaw would likely leverage T1499 (Service Exhaustion Denial of Service) through crafted network traffic that creates excessive expectation objects, exhausting kernel memory without proper cleanup. Detection would involve monitoring for abnormal memory consumption in netfilter subsystems, unexpected kernel panics on systems handling high-volume connection tracking, and resource starvation indicators. Security teams should focus monitoring on systems exposed to untrusted network traffic and prioritize kernel patching, while using Casky's reasoning framework to correlate system resource anomalies with potential netfilter exploitation patterns.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80668. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation