The Netfilter nf_conncount module was enhanced to trigger garbage collection only once per jiffy. If more than eight new connections are added in a single jiffy, the cleanup fails to keep pace, potentially inflating the connection table and causing a resource exhaustion. This can drop legitimate connections and lead to denial of service for network services using the kernel’s connection tracking. The weakness is excessive resource consumption, catalogued as CWE‑770.

Any Linux distribution employing the stock Linux kernel with the original nf_conncount cleanup threshold is vulnerable until the patch raising the limit to 64 connections and adding a guard is applied. This includes all kernels shipped before the commit 0792ad07… in the kernel source tree. Users of nft_connlimit, xt_connlimit, or Open vSwitch limits would also be affected during high‑rate connection churn.

Based on the description, it is inferred that the attack vector is remote network traffic that rapidly opens many short‑lived connections, such as a traffic generator or a service that spawns a burst of new sockets. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a relatively low exploitation probability. However, the CVSS score of 7.5 denotes moderate severity, and if an attacker can sustain a burst of more than eight new connections per jiffy against a target, the connection table may saturate, leading to denial of service for legitimate traffic.