The Linux kernel’s netfilter nf_conncount module suffered a regression when commit 69894e5b was applied. Packets for connections that reuse a socket in the TIME_WAIT state are mistakenly treated as already confirmed. The code then skips adding the new connection to the tracking table and triggers garbage collection that removes the TIME_WAIT entry, causing the connection count to drop to zero. Because connlimit depends on this count for soft‑limiting, the framework falsely rejects the legitimate new connection, resulting in a denial of legitimate traffic. This flaw involves improper handling of connection states and resource exhaustion logic (CWE-367).

All Linux kernel builds that include the netfilter nf_conncount and connlimit modules are vulnerable until the regression is corrected. The regression was introduced by commit 69894e5b, but no specific fix commit is identified in the CVE data. Kernel versions prior to any update that implements the described fix remain susceptible.

The assigned CVSS score of 7.5 reflects a high impact on availability. The EPSS score is less than 1%, indicating that exploitation attempts are expected to be rare in the wild. The defect is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, involves generating traffic patterns that force reuse of TIME_WAIT sockets – for example, high‑rate connection churn or SYN flooding – to trigger the false drop. While no public exploits are documented, the combination of a high availability consequence and the potential to induce the condition suggests that timely patch deployment is advisable.