The Linux kernel module nf_conncount incorrectly updates the last_gc counter on each new tracked connection instead of only after a garbage collection cycle. This oversight allows an attacker to sustain a high packet or connection rate that keeps the GC from running. By continually bypassing the GC, the connection table expands unbounded, eventually exhausting kernel memory and degrading system performance, potentially causing a denial of service.

The flaw is present in the nf_conncount implementation of the Linux kernel, which is part of the netfilter subsystem. It was identified in kernel version 6.19 release candidates 1 through 4, and the vulnerability description indicates the issue exists in all builds that include the same nf_conncount code without the recent fix. Consequently, systems running these kernel versions—or any kernel builds that have not yet incorporated the fix—are susceptible.

The CVSS score of 7.5 reflects a high severity due to the potential for direct resource depletion via network traffic. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack would require an adversary able to send a sustained high‑rate stream of packets that establish new connections, which could be achieved by an external attacker with network access to the target. Successful exploitation would result in memory exhaustion and system slowdown or crash, with the attacker not gaining elevated privileges.