CVE-2026-80668 is a use-after-free in Linux netfilter connection tracking: an expectation created by a protocol helper (FTP, SIP, H.323) can outlive its master connection. The kernel.org CNA rates it CVSS 9.8, remote and unauthenticated. Red Hat rates it Moderate.

On CentOS 7 it reaches the kernel most servers still run:

  • Stock 3.10: affected, per Red Hat, and CentOS 7 gets no kernel updates. Automatic helper assignment is still on (net.netfilter.nf_conntrack_helper = 1). In a test VM, enabling firewalld's ftp service and sending one PASV from an unauthenticated client created the object this bug frees too early.
  • ELRepo kernel-lt 5.4.278 and kernel-ml 6.9.7: outside this CVE's affected range, but both carry CVE-2026-99270, a remote TCP use-after-free, and get no more builds.

The fix

Disclosure: I maintain this package. GetPageSpeed's kernel-lt 6.18.62 uses the same package name, installs beside your current kernel, and is free for any use:

yum -y install https://extras.getpagespeed.com/release-latest.rpm yum -y install yum-utils yum-config-manager --enable getpagespeed-extras-corecare yum -y install kernel-lt grub2-set-default 0 grubby --default-kernel reboot

Already on our 6.18 kernel? yum -y update 'kernel-lt*' is enough: 6.18.62-2 makes the new kernel the GRUB default itself, which earlier packages did not.

I ran both paths on CentOS 7 VMs against the live repository. The exposure checks, a stopgap for servers you cannot reboot yet, and the rollback are in the full write-up.