netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid connections are dropped when using connlimit for soft-limiting scenarios. The issue occurs when a new connection reuses a socket currently in the TIME_WAIT state. In this scenario, the connection tracking entry is evaluated as already confirmed. Previously, __nf_conncount_add() assumed that if a connection was confirmed and did not originate from the loopback interface, it should skip the addition and return -EEXIST. Skipping the addition triggers a garbage collection run that cleans up the TIME_WAIT connection. Consequently, the active connection count drops to 0, which xt_connlimit mishandles, leading to the false rejection of the perfectly valid new connection. Fix this by replacing the interface check with protocol-agnostic state checks. We now skip the tree insertion and preserve the lockless garbage collection optimization only if the connection is IPS_ASSURED. This allows early-confirmed setup packets (such as reused TIME_WAIT sockets or locally generated SYN-ACKs) to be properly evaluated and counted without falsely dropping. The goto check_connections path is maintained to ensure these setup packets are deduplicated correctly. This has been tested with slowhttptest and HTTP server configured locall
CVE-2026-72418
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-72418
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "460c112e1d887b58b06b56e8e0230058906ff2c3",
"lessThan": "000ac6830b56499d6b65fd91486ce6689eb02be4",
"versionType": "git"
},
{
"status": "affected",
"version": "53bc0ac47f4f7621c991807bc90e01df49561ac8",
"lessThan": "cbe2d14a7c5b1fc71821fbfee5c4963917411e92",
"versionType": "git"
},
{
"status": "affected",
"version": "ca8b4d1d6304a84ce2016fa2fe9a114b9607b839",
"lessThan": "3793d24de224943e0a6016bbeffb6f5c4cea2e3d",
"versionType": "git"
},
{
"status": "affected",
"version": "8286c02fe9100330475331253fc590f047963f90",
"lessThan": "abef7f817217fcb62c11821d6b895063eadb2828",
"versionType": "git"
},
{
"status": "affected",
"version": "b29ddccf36946a90323486221f39e9f88cc01b8e",
"lessThan": "ebfe8249ba79e4ff0f1e3aad8787b992ef27f026",
"versionType": "git"
},
{
"status": "affected",
"version": "77ea3d8ac3d3d59b5ac9ad639e4ba107c0f2ff1e",
"lessThan": "329f2626ee5cb8fafdf6b58b624311529c57cb45",
"versionType": "git"
},
{
"status": "affected",
"version": "69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e",
"lessThan": "be52572c6d55f677ba76869d3c63805c0d4891a3",
"versionType": "git"
},
{
"status": "affected",
"version": "69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e",
"lessThan": "c8b6f36f766991e3ebebec6596daee4b04dcbc49",
"versionType": "git"
},
{
"status": "affected",
"version": "f85623af16b83615e5f64a9b19ae1d584805cb07",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.248",
"lessThan": "5.10.261",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.198",
"lessThan": "5.15.212",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.160",
"lessThan": "6.1.178",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.120",
"lessThan": "6.6.145",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.63",
"lessThan": "6.12.97",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.2",
"lessThan": "6.18.40",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.17.13",
"lessThan": "6.18",
"versionType": "semver"
}
],
"programFiles": [
"net/netfilter/nf_conncount.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/nf_conncount.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-72418
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #33047 · Revision 1
- Added to Heist Feed
- Publisher date