DEBIAN-CVE-2026-80603

In the Linux kernel, the following vulnerability has been resolved:  netfilter: nfconntrackirc: fix parsedcc() off-by-one OOB read  parsedcc() treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte.  The newline search loop iterates while tmp <= dataend, so when no newline is present, *tmp is read at tmp == dataend, one byte beyond the region filled by skbheaderpointer().  ircbuffer is kmalloc'd as MAXSEARCHSIZE + 1 bytes and datalen is capped at MAXSEARCHSIZE, so the stray read does not fault.  The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation.  The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read.  Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention.  Update the function comment accordingly.