CVE-2026-72418

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add

was skipped") introduced a regression where packets for valid

connections are dropped when using connlimit for soft-limiting

scenarios.

The issue occurs when a new connection reuses a socket currently in

the TIME_WAIT state. In this scenario, the connection tracking entry

is evaluated as already confirmed. Previously, __nf_conncount_add()

assumed that if a connection was confirmed and did not originate from

the loopback interface, it should skip the addition and return -EEXIST.

Skipping the addition triggers a garbage collection run that cleans up

the TIME_WAIT connection. Consequently, the active connection count

drops to 0, which xt_connlimit mishandles, leading to the false rejection

of the perfectly valid new connection.

Fix this by replacing the interface check with p

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References