In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackirc: fix parse_dcc() off-by-one OOB read
parsedcc() treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte.
The newline search loop iterates while tmp <= dataend, so when no newline is present, *tmp is read at tmp == dataend, one byte beyond the region filled by skbheaderpointer().
ircbuffer is kmalloc'd as MAXSEARCHSIZE + 1 bytes and datalen is capped at MAXSEARCHSIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simplestrtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read.
Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80603.json",
"cna_assigner": "Linux"
}