---
id: CVE-2026-72418
title: 'netfilter: nf_conncount: prevent connlimit drops for early confirmed ct'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

  Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
  was skipped") introduce…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 460c112e1d887b58b06b56e8e0230058906ff2c3 <
    000ac6830b56499d6b65fd91486ce6689eb02be4
  - >-
    Linux >= 53bc0ac47f4f7621c991807bc90e01df49561ac8 <
    cbe2d14a7c5b1fc71821fbfee5c4963917411e92
  - >-
    Linux >= ca8b4d1d6304a84ce2016fa2fe9a114b9607b839 <
    3793d24de224943e0a6016bbeffb6f5c4cea2e3d
  - >-
    Linux >= 8286c02fe9100330475331253fc590f047963f90 <
    abef7f817217fcb62c11821d6b895063eadb2828
  - >-
    Linux >= b29ddccf36946a90323486221f39e9f88cc01b8e <
    ebfe8249ba79e4ff0f1e3aad8787b992ef27f026
  - >-
    Linux >= 77ea3d8ac3d3d59b5ac9ad639e4ba107c0f2ff1e <
    329f2626ee5cb8fafdf6b58b624311529c57cb45
  - >-
    Linux >= 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e <
    be52572c6d55f677ba76869d3c63805c0d4891a3
  - >-
    Linux >= 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e <
    c8b6f36f766991e3ebebec6596daee4b04dcbc49
  - Linux f85623af16b83615e5f64a9b19ae1d584805cb07
  - Linux >= 5.10.248 < 5.10.261
  - Linux >= 5.15.198 < 5.15.212
  - Linux >= 6.1.160 < 6.1.178
  - Linux >= 6.6.120 < 6.6.145
  - Linux >= 6.12.63 < 6.12.97
  - Linux >= 6.18.2 < 6.18.40
  - Linux >= 6.17.13 < 6.18
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:49:23.434729Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:22.660Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72418'
references:
  - url: 'https://git.kernel.org/stable/c/000ac6830b56499d6b65fd91486ce6689eb02be4'
  - url: 'https://git.kernel.org/stable/c/cbe2d14a7c5b1fc71821fbfee5c4963917411e92'
  - url: 'https://git.kernel.org/stable/c/3793d24de224943e0a6016bbeffb6f5c4cea2e3d'
  - url: 'https://git.kernel.org/stable/c/abef7f817217fcb62c11821d6b895063eadb2828'
  - url: 'https://git.kernel.org/stable/c/ebfe8249ba79e4ff0f1e3aad8787b992ef27f026'
  - url: 'https://git.kernel.org/stable/c/329f2626ee5cb8fafdf6b58b624311529c57cb45'
  - url: 'https://git.kernel.org/stable/c/be52572c6d55f677ba76869d3c63805c0d4891a3'
  - url: 'https://git.kernel.org/stable/c/c8b6f36f766991e3ebebec6596daee4b04dcbc49'
tags:
  - cve.org
epss: 0.00716
epssPercentile: 0.52837
ingestedAt: '2026-10-16T19:46:24.398Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
was skipped") introduced a regression where packets for valid
connections are dropped when using connlimit for soft-limiting
scenarios.

The issue occurs when a new connection reuses a socket currently in
the TIME_WAIT state. In this scenario, the connection tracking entry
is evaluated as already confirmed. Previously, __nf_conncount_add()
assumed that if a connection was confirmed and did not originate from
the loopback interface, it should skip the addition and return -EEXIST.

Skipping the addition triggers a garbage collection run that cleans up
the TIME_WAIT connection. Consequently, the active connection count
drops to 0, which xt_connlimit mishandles, leading to the false rejection
of the perfectly valid new connection.

Fix this by replacing the interface check with protocol-agnostic state
checks. We now skip the tree insertion and preserve the lockless garbage
collection optimization only if the connection is IPS_ASSURED. This
allows early-confirmed setup packets (such as reused TIME_WAIT sockets
or locally generated SYN-ACKs) to be properly evaluated and counted
without falsely dropping. The goto check_connections path is maintained
to ensure these setup packets are deduplicated correctly.

This has been tested with slowhttptest and HTTP server configured
locally to ensure we are not breaking soft-limiting scenarios for local
or external connections. In addition, it was tested with a OVS zone
limit too.

## Affected

- `Linux >= 460c112e1d887b58b06b56e8e0230058906ff2c3 < 000ac6830b56499d6b65fd91486ce6689eb02be4`
- `Linux >= 53bc0ac47f4f7621c991807bc90e01df49561ac8 < cbe2d14a7c5b1fc71821fbfee5c4963917411e92`
- `Linux >= ca8b4d1d6304a84ce2016fa2fe9a114b9607b839 < 3793d24de224943e0a6016bbeffb6f5c4cea2e3d`
- `Linux >= 8286c02fe9100330475331253fc590f047963f90 < abef7f817217fcb62c11821d6b895063eadb2828`
- `Linux >= b29ddccf36946a90323486221f39e9f88cc01b8e < ebfe8249ba79e4ff0f1e3aad8787b992ef27f026`
- `Linux >= 77ea3d8ac3d3d59b5ac9ad639e4ba107c0f2ff1e < 329f2626ee5cb8fafdf6b58b624311529c57cb45`
- `Linux >= 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e < be52572c6d55f677ba76869d3c63805c0d4891a3`
- `Linux >= 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e < c8b6f36f766991e3ebebec6596daee4b04dcbc49`
- `Linux f85623af16b83615e5f64a9b19ae1d584805cb07`
- `Linux >= 5.10.248 < 5.10.261`
- `Linux >= 5.15.198 < 5.15.212`
- `Linux >= 6.1.160 < 6.1.178`
- `Linux >= 6.6.120 < 6.6.145`
- `Linux >= 6.12.63 < 6.12.97`
- `Linux >= 6.18.2 < 6.18.40`
- `Linux >= 6.17.13 < 6.18`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.