REDHAT-BUG-2492770: Medium severity The Linux Kernel Project Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrackirc: fix possible out-of-bounds read
When parsing fails after we've matched the command string we should bail out instead of trying to match a different command.
This helper should be deprecated, given prevalence of TLS I doubt it has any relevance in 2026.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Exposure is limited to systems using the netfilter IRC connection-tracking helper to parse IRC traffic. The advisory notes that widespread use of TLS makes the helper unlikely to have much relevance in 2026.
What does an attacker need to trigger the flaw?
The attacker would need traffic processed by the IRC conntrack helper where parsing fails after a command string has already matched. In that condition, the helper could continue attempting to match another command and perform an out-of-bounds read.
Is a non-patch mitigation specified?
No specific temporary mitigation is provided. The advisory states that the IRC conntrack helper should be deprecated.