CVE-2026-72418

Status: UPDATED  |  Advisory ID: CVE-2026-72418

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add

was skipped") introduced a regression where packets for valid

connections are dropped when using connlimit for soft-limiting

scenarios.

The issue occurs when a new connection reuses a socket currently in

the TIME_WAIT state. In this scenario, the connection tracking entry

is evaluated as already confirmed. Previously, __nf_conncount_add()

assumed that if a connection was confirmed and did not originate from

the loopback interface, it should skip the addition and return -EEXIST.

Skipping the addition triggers a garbage collection run that cleans up

the TIME_WAIT connection. Consequently, the active connection count

drops to 0, which xt_connlimit mishandles, leading to the false rejection

of the perfectly valid new connection.

Fix this by replacing the interface check with protocol-agnostic state

checks. We now skip the tree insertion and preserve the lockless garbage

collection optimization only if the connection is IPS_ASSURED. This

allows early-confirmed setup packets (such as reused TIME_WAIT sockets

or locally generated SYN-ACKs) to be properly evaluated and counted

without falsely dropping. The goto check_connections path is maintained

to ensure these setup packets are deduplicated correctly.

This has been tested with slowhttptest and HTTP server configured

locally to ensure we are not breaking soft-limiting scenarios for local

or external connections. In addition, it was tested with a OVS zone

limit too. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References