CVE-2026-72247 - Vulnerability Details

- netfilter: nf_conncount: fix zone comparison in tuple dedup

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: fix zone comparison in tuple dedup

The "already exists" dedup logic in __nf_conncount_add() decides
whether a connection has already been counted and can be skipped instead
of incrementing the connlimit count. It compares the conntrack zone of a
list entry with the zone of the connection being added using
nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
zone->dir as the direction argument.

Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0
and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:
NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and
NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction
shifts the meaning of every non-zero value. An ORIG-only zone passes 1
and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and
test bits beyond the valid direction range. In those cases
nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using
the real zone id, so different zones can be treated as equal and dedup
collapses to tuple equality alone.

nf_conncount stores and compares the original-direction tuple for a
connection. If an skb already has an attached conntrack entry,
get_ct_or_tuple_from_skb() explicitly copies
ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's
ctinfo. Therefore the zone comparison in the tuple dedup path must use
IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a
zone id applies, not which direction this conncount tuple represents.

Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.
Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone
ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the
direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional
zone contains the ORIG bit, so it naturally returns the real zone id;
reply-only zones continue to fall back for original-direction tuple
comparisons.

Published: 2026-08-15

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A logic error in the Linux kernel’s nf_conncount module causes the zone comparison during connection deduplication to treat non‑original direction zones as original. This oversight means that connections can be counted incorrectly or skipped altogether, bypassing the kernel’s connection‑limit enforcement and potentially disabling network rate‑limiting or DoS protection.

Affected Systems

The flaw exists in the Linux kernel before the patch that fixes the zone comparison logic. All distributions shipping a kernel that lacks the commit fixing this issue are affected; upgrading to a kernel that includes the fix restores proper connection counting behavior.

Risk and Exploitability

The CVSS score of 7.5 reflects the severity of this denial‑of‑service impact, while the EPSS score of < 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker could, in theory, generate a flood of connections that bypass the connection limits if the kernel is vulnerable, leading to resource exhaustion. No public exploits are known, and the flaw requires network traffic that triggers nf_conncount processing.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 82fc35e0da9a91db9a034f8311f18f77a599ae3f
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 78b5d6dbc860776161f9e9206b06ff8a01f531ab
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 4f30a89c0ed2418719a1144881c2635b940b543d
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 7bdc3c0985ecf17b957811fedcc684acdf698acc
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 35a56e2a46b90e6bd4ca816b80e9cb8d20dfc3ce
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 3cd9a5792cbea81139c24320986dd0db69e9b5d0
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< 6ff07ac5405bea4d4ead3559fc123f987576424a
`21ba8847f857028dc83a0f341e16ecc616e34740`	affected	< f62c41b4910e65da396ec9a8c40c1fe7fe82e449
`525e1dffed8711973f77412729621098a95238e5`	affected	—
`75af3d78168e654a5cd8bbc4c774f97be836165f`	affected	—
`4.14.92`	affected	< 4.15

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[21ba8847f857028dc83a0f341e16ecc616e34740,82fc35e0da9a91db9a034f8311f18f77a599ae3f)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,78b5d6dbc860776161f9e9206b06ff8a01f531ab)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,4f30a89c0ed2418719a1144881c2635b940b543d)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,6ff07ac5405bea4d4ead3559fc123f987576424a)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,7bdc3c0985ecf17b957811fedcc684acdf698acc)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,35a56e2a46b90e6bd4ca816b80e9cb8d20dfc3ce)`	affected	code_commit	—
`[21ba8847f857028dc83a0f341e16ecc616e34740,3cd9a5792cbea81139c24320986dd0db69e9b5d0)`	affected	code_commit	—
`525e1dffed8711973f77412729621098a95238e5`	affected	code_commit	—
`75af3d78168e654a5cd8bbc4c774f97be836165f`	affected	code_commit	—
`[4.14.92,4.15)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit fixing the nf_conncount zone comparison error; use the latest vendor‑sponsored kernel release or apply the patch from the kernel source tree.
If an update is not yet available, monitor inbound connection activity for abnormal volume and enforce external firewall or router‑level connection limits to mitigate potential resource exhaustion.
Consider temporarily disabling the nf_conncount feature or reducing its thresholds until the kernel patch is applied, ensuring that critical services remain protected while the vulnerability is addressed.

Generated by OpenCVE AI on August 18, 2026 at 04:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00696.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/35a56e2a46b90e6bd4ca816b80e9cb8d20dfc3ce
https://git.kernel.org/stable/c/3cd9a5792cbea81139c24320986dd0db69e9b5d0
https://git.kernel.org/stable/c/4f30a89c0ed2418719a1144881c2635b940b543d
https://git.kernel.org/stable/c/6ff07ac5405bea4d4ead3559fc123f987576424a
https://git.kernel.org/stable/c/78b5d6dbc860776161f9e9206b06ff8a01f531ab
https://git.kernel.org/stable/c/7bdc3c0985ecf17b957811fedcc684acdf698acc
https://git.kernel.org/stable/c/82fc35e0da9a91db9a034f8311f18f77a599ae3f
https://git.kernel.org/stable/c/f62c41b4910e65da396ec9a8c40c1fe7fe82e449
https://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-72247-73b5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72247
https://www.cve.org/CVERecord?id=CVE-2026-72247

History

Tue, 18 Aug 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-681

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-628
References		https://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-72247-73b5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72247 https://www.cve.org/CVERecord?id=CVE-2026-72247
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-681

Mon, 17 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 15 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison in tuple dedup The "already exists" dedup logic in __nf_conncount_add() decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. It compares the conntrack zone of a list entry with the zone of the connection being added using nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or zone->dir as the direction argument. Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0 and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask: NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction shifts the meaning of every non-zero value. An ORIG-only zone passes 1 and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and test bits beyond the valid direction range. In those cases nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using the real zone id, so different zones can be treated as equal and dedup collapses to tuple equality alone. nf_conncount stores and compares the original-direction tuple for a connection. If an skb already has an attached conntrack entry, get_ct_or_tuple_from_skb() explicitly copies ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's ctinfo. Therefore the zone comparison in the tuple dedup path must use IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a zone id applies, not which direction this conncount tuple represents. Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly. Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional zone contains the ORIG bit, so it naturally returns the real zone id; reply-only zones continue to fall back for original-direction tuple comparisons.
Title		netfilter: nf_conncount: fix zone comparison in tuple dedup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/35a56e2a46b90e6bd4ca816b80e9cb8d20dfc3ce https://git.kernel.org/stable/c/3cd9a5792cbea81139c24320986dd0db69e9b5d0 https://git.kernel.org/stable/c/4f30a89c0ed2418719a1144881c2635b940b543d https://git.kernel.org/stable/c/6ff07ac5405bea4d4ead3559fc123f987576424a https://git.kernel.org/stable/c/78b5d6dbc860776161f9e9206b06ff8a01f531ab https://git.kernel.org/stable/c/7bdc3c0985ecf17b957811fedcc684acdf698acc https://git.kernel.org/stable/c/82fc35e0da9a91db9a034f8311f18f77a599ae3f https://git.kernel.org/stable/c/f62c41b4910e65da396ec9a8c40c1fe7fe82e449

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:35.201Z

Updated: 2026-08-17T05:41:58.867Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72247

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:51.887

Modified: 2026-08-17T06:18:26.563

Link: CVE-2026-72247

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72247 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:30:06Z

Weaknesses

CWE-628
Function Call with Incorrectly Specified Arguments

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object