CVE-2026-72247

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: fix zone comparison in tuple dedup

The "already exists" dedup logic in __nf_conncount_add() decides

whether a connection has already been counted and can be skipped instead

of incrementing the connlimit count. It compares the conntrack zone of a

list entry with the zone of the connection being added using

nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or

zone->dir as the direction argument.

Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0

and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:

NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and

NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction

shifts the meaning of every non-zero value. An ORIG-only zone passes 1

and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and

test bits beyond the valid direction range. In those cases

nf_ct_zone_id() can fal

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References