netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72418
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:22:15 UTC
Updated2026-08-17 06:19:08 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid connections are dropped when using connlimit for soft-limiting scenarios. The issue occurs when a new connection reuses a socket currently in the TIME_WAIT state. In this scenario, the connection tracking entry is evaluated as already confirmed. Previously, __nf_conncount_add() assumed that if a connection was confirmed and did not originate from the loopback interface, it should skip the addition and return -EEXIST. Skipping the addition triggers a garbage collection run that cleans up the TIME_WAIT connection. Consequently, the active connection count drops to 0, which xt_connlimit mishandles, leading to the false rejection of the perfectly valid new connection. Fix this by replacing the interface check with protocol-agnostic state checks. We now skip the tree insertion and preserve the lockless garbage collection optimization only if the connection is IPS_ASSURED. This allows early-confirmed setup packets (such as reused TIME_WAIT sockets or locally generated SYN-ACKs) to be properly evaluated and counted without falsely dropping. The goto check_connections path is maintained to ensure these setup packets are deduplicated correctly. This has been tested with slowhttptest and HTTP server configured locally to ensure we are not breaking soft-limiting scenarios for local or external connections. In addition, it was tested with a OVS zone limit too.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.007160000 probability, percentile 0.507270000 (date 2026-08-17)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 460c112e1d887b58b06b56e8e0230058906ff2c3 000ac6830b56499d6b65fd91486ce6689eb02be4 git Not specified
CNA Linux Linux affected 53bc0ac47f4f7621c991807bc90e01df49561ac8 cbe2d14a7c5b1fc71821fbfee5c4963917411e92 git Not specified
CNA Linux Linux affected ca8b4d1d6304a84ce2016fa2fe9a114b9607b839 3793d24de224943e0a6016bbeffb6f5c4cea2e3d git Not specified
CNA Linux Linux affected 8286c02fe9100330475331253fc590f047963f90 abef7f817217fcb62c11821d6b895063eadb2828 git Not specified
CNA Linux Linux affected b29ddccf36946a90323486221f39e9f88cc01b8e ebfe8249ba79e4ff0f1e3aad8787b992ef27f026 git Not specified
CNA Linux Linux affected 77ea3d8ac3d3d59b5ac9ad639e4ba107c0f2ff1e 329f2626ee5cb8fafdf6b58b624311529c57cb45 git Not specified
CNA Linux Linux affected 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e be52572c6d55f677ba76869d3c63805c0d4891a3 git Not specified
CNA Linux Linux affected 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e c8b6f36f766991e3ebebec6596daee4b04dcbc49 git Not specified
CNA Linux Linux affected f85623af16b83615e5f64a9b19ae1d584805cb07 git Not specified
CNA Linux Linux affected 5.10.248 5.10.261 semver Not specified
CNA Linux Linux affected 5.15.198 5.15.212 semver Not specified
CNA Linux Linux affected 6.1.160 6.1.178 semver Not specified
CNA Linux Linux affected 6.6.120 6.6.145 semver Not specified
CNA Linux Linux affected 6.12.63 6.12.97 semver Not specified
CNA Linux Linux affected 6.18.2 6.18.40 semver Not specified
CNA Linux Linux affected 6.17.13 6.18 semver Not specified
CNA Linux Linux affected 6.19 Not specified
CNA Linux Linux unaffected 6.19 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/3793d24de224943e0a6016bbeffb6f5c4cea2e3d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ebfe8249ba79e4ff0f1e3aad8787b992ef27f026 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c8b6f36f766991e3ebebec6596daee4b04dcbc49 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be52572c6d55f677ba76869d3c63805c0d4891a3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/000ac6830b56499d6b65fd91486ce6689eb02be4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/329f2626ee5cb8fafdf6b58b624311529c57cb45 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/abef7f817217fcb62c11821d6b895063eadb2828 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cbe2d14a7c5b1fc71821fbfee5c4963917411e92 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report