CVE-2026-72247

Status: UPDATED  |  Advisory ID: CVE-2026-72247

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: fix zone comparison in tuple dedup

The "already exists" dedup logic in __nf_conncount_add() decides

whether a connection has already been counted and can be skipped instead

of incrementing the connlimit count. It compares the conntrack zone of a

list entry with the zone of the connection being added using

nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or

zone->dir as the direction argument.

Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0

and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:

NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and

NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction

shifts the meaning of every non-zero value. An ORIG-only zone passes 1

and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and

test bits beyond the valid direction range. In those cases

nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using

the real zone id, so different zones can be treated as equal and dedup

collapses to tuple equality alone.

nf_conncount stores and compares the original-direction tuple for a

connection. If an skb already has an attached conntrack entry,

get_ct_or_tuple_from_skb() explicitly copies

ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's

ctinfo. Therefore the zone comparison in the tuple dedup path must use

IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a

zone id applies, not which direction this conncount tuple represents.

Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.

Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone

ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the

direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional

zone contains the ORIG bit, so it naturally returns the real zone id;

reply-only zones continue to fall back for original-direction tuple

comparisons. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References