CVE-2026-72418

Received Received - Intake

Linux Kernel Netfilter Connlimit Connection Tracking Bypass

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid connections are dropped when using connlimit for soft-limiting scenarios. The issue occurs when a new connection reuses a socket currently in the TIME_WAIT state. In this scenario, the connection tracking entry is evaluated as already confirmed. Previously, __nf_conncount_add() assumed that if a connection was confirmed and did not originate from the loopback interface, it should skip the addition and return -EEXIST. Skipping the addition triggers a garbage collection run that cleans up the TIME_WAIT connection. Consequently, the active connection count drops to 0, which xt_connlimit mishandles, leading to the false rejection of the perfectly valid new connection. Fix this by replacing the interface check with protocol-agnostic state checks. We now skip the tree insertion and preserve the lockless garbage collection optimization only if the connection is IPS_ASSURED. This allows early-confirmed setup packets (such as reused TIME_WAIT sockets or locally generated SYN-ACKs) to be properly evaluated and counted without falsely dropping. The goto check_connections path is maintained to ensure these setup packets are deduplicated correctly. This has been tested with slowhttptest and HTTP server configured locally to ensure we are not breaking soft-limiting scenarios for local or external connections. In addition, it was tested with a OVS zone limit too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72418

EUVD

EUVD-2026-59317

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a regression in the netfilter connlimit feature. When a new connection reuses a socket in TIME_WAIT state, the connection tracking entry is marked as confirmed. The system incorrectly skips adding this connection to the count, triggering garbage collection that removes the TIME_WAIT connection. This causes the active connection count to drop to zero, leading the xt_connlimit module to falsely reject valid new connections.

Detection Guidance

This vulnerability affects the Linux kernel's netfilter connlimit feature. Detection requires checking kernel logs for connection drops or errors related to nf_conncount or nft_connlimit. Monitor logs with commands like 'dmesg | grep connlimit' or 'journalctl -k | grep -i connlimit'. If using nftables, inspect rules with 'nft list ruleset' and look for connlimit rules.

Impact Analysis

If you use Linux systems with netfilter connlimit rules for soft-limiting connections, this vulnerability may cause valid new connections to be dropped. This could disrupt services relying on connection limits, such as web servers or network applications, leading to denial of service or connectivity issues.

Compliance Impact

This vulnerability affects network traffic handling in the Linux kernel, specifically causing valid connections to be dropped when using connlimit for soft-limiting scenarios. This could lead to disruptions in network services, potentially impacting compliance with standards requiring reliable data processing or secure communications, such as GDPR (data integrity) or HIPAA (availability of critical systems).

Mitigation Strategies

Apply the kernel patch referenced in the CVE (commit 69894e5b4c5e or later). Update the Linux kernel to a version containing the fix. If immediate patching is not possible, disable connlimit rules in nftables or iptables until the update is applied.

Hi! I’m here to help you understand CVE-2026-72418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70