CVE-2026-23139

Root

Cause

The vulnerability resides in the Linux kernel's netfilter connection tracking subsystem (nf_conncount). The last_gc timestamp, which controls when the garbage collector (GC) runs, was being updated on every new connection tracking event, regardless of whether a GC cycle was actually performed [1]. This means that under a sufficiently high packet rate, the GC could be perpetually skipped because last_gc was always refreshed before the GC threshold was reached.

Exploitation

An attacker can exploit this by generating a high rate of new connections (e.g., via rapid-fire SYN packets or other connection-establishing traffic) that target a system using nf_conncount. Because last_gc is updated with each new connection, the GC never triggers, allowing the connection tracking the connection list grows without bound [1]. No authentication is required if the attacker can send network traffic to the victim host; the attack surface is the network-facing connection tracking infrastructure.

Impact

If the connection list grows infinitely, it will consume an ever-increasing amount of kernel memory. This can lead to resource exhaustion. This can cause denial of service (DoS) by starving the system of memory or by triggering out-of-memory conditions, potentially crashing the host or making it unresponsive [1]. The CVSS v3 score of 7.5 (High) reflects the ease of triggering this condition and the severity of the resulting DoS.

Mitigation

The fix, committed to the Linux kernel stable tree, updates last_gc only when a GC cycle has actually been performed [1]. This ensures that the GC runs at the intended interval intervals regardless of connection rate. Users should apply the patched kernel version containing commit 8bdafdf49000 (or equivalent backports) to remediate the vulnerability.