In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: update last_gc only when GC has been performed

Currently last_gc is being updated everytime a new connection is
tracked, that means that it is updated even if a GC wasn't performed.
With a sufficiently high packet rate, it is possible to always bypass
the GC, causing the list to grow infinitely.

Update the last_gc value only when a GC has been actually performed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f106694733c66a48740c25bc4e212e9b2ea364ce affected < 2c7c71113ed6d3e2f3aca4c088f22283016ff34f
be69850b461e7b491d87a22e33ab76fdd04b725e affected < c4cde57c8affdcca5bcff53a1047e15d268bdca1
d265929930e2ffafc744c0ae05fb70acd53be1ee affected < 9f45588993d7f115280fc726119ca86fba32a811
d265929930e2ffafc744c0ae05fb70acd53be1ee affected < 3cd717359e56f82f06cbf8279b47a7d79880c6f3
d265929930e2ffafc744c0ae05fb70acd53be1ee affected < 26a82dce2beee39c43c109d9647e16f49cb02a35
d265929930e2ffafc744c0ae05fb70acd53be1ee affected < 8bdafdf4900040a81422056cabe5e00a37bd101a
d265929930e2ffafc744c0ae05fb70acd53be1ee affected < 7811ba452402d58628e68faedf38745b3d485e3c
Linux Linux affected
Version Status Constraints
5.19 affected —
0 unaffected < 5.19
6.1.161 unaffected ≤ 6.1.*
6.6.121 unaffected ≤ 6.6.*
6.12.66 unaffected ≤ 6.12.*
6.18.6 unaffected ≤ 6.18.*
6.19 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35 cve-icon cve-icon
https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f cve-icon cve-icon
https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3 cve-icon cve-icon
https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c cve-icon cve-icon
https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a cve-icon cve-icon
https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811 cve-icon cve-icon
https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1 cve-icon cve-icon
History

Sat, 14 Feb 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely. Update the last_gc value only when a GC has been actually performed.
Title netfilter: nf_conncount: update last_gc only when GC has been performed
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-14T15:22:24.059Z

Reserved: 2026-01-13T15:37:45.972Z

Link: CVE-2026-23139

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-02-14T16:15:53.950

Modified: 2026-02-14T16:15:53.950

Link: CVE-2026-23139

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.