The Netfilter nf_conncount module was designed to cap active connections per monitoring rule, but a recent GC optimisation only performs one garbage collection per jiffy. When more than eight new connections are tracked in a single jiffy, the list is not cleaned promptly, potentially hitting the mis‑calculated limit and causing the tracking table to become saturated. This can result in legitimate connections being dropped or denied, effectively creating a denial‑of‑service condition. The root weakness involves inadequate resource cleanup limits (CWE‑400) and failure to enforce imposed limits correctly (CWE‑770). The kernel patch raises the cleanup threshold to 64 connections and adds a guard to skip repeated GC within the same jiffy, eliminating the OSI‑level resource exhaustion that attackers could exploit.

Any Linux kernel that implements the nf_conncount module with the original cleanup limit is potentially vulnerable. No specific version range is listed in the advisory, meaning all downstream kernels that have not yet received the patch are at risk. The fix resides in the mainline kernel, so all distributions shipping the stock kernel are relevant until they update.

The EPSS score for this issue is not publicly available and it is not listed in CISA’s KEV catalog. Because the vulnerability hinges on creating a burst of more than eight new connections per jiffy, exploitation would require a high‑rate connection initiation, which can be achieved by a traffic generator or by an application that rapidly opens many short‑lived connections. Attackers could target servers that rely heavily on netfilter connection tracking, causing the tracking table to saturate and legitimate connections to fail. The lack of a public CVSS score makes precise risk estimation difficult, but the described Denial‑of‑Service mechanism coupled with the potential for high‑rate connection churn indicates a noteworthy risk for exposed services if the kernel is not patched.