CVE-2014-8160: net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack en...

Security readout for executives and security teams

This Linux kernel flaw could let network traffic slip past firewall rules in specific configurations. The issue affects conntrack handling for SCTP, DCCP, GRE, and UDP-Lite, where packets using disallowed port numbers may still be accepted. Business urgency depends on whether older or vendor-backported kernels and relevant iptables rules remain in use. Exposure is most likely on systems running Linux kernels before 3.18, or vendor kernels without the relevant backport, using iptables/conntrack rules for SCTP, DCCP, GRE, or UDP-Lite. Internet-facing firewalls, gateways, and hosts relying on these protocol rules deserve priority review. Prioritize remediation where old Linux kernels enforce network boundaries or expose services to untrusted networks. The issue is old and not KEV-listed, but firewall bypass risk can be material if legacy kernels or appliances remain deployed. Mitigation focus: Apply the relevant vendor kernel security update for each Linux distribution.; Confirm the running kernel includes the upstream or vendor-backported fix.; Reboot systems after kernel update where required by vendor guidance..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.