The regression introduced by commit 69894e5b in the Linux kernel’s netfilter nf_conncount module causes valid network connections to be erroneously dropped. It occurs when a new connection reuses a socket that is still in the TIME_WAIT state. The connection is incorrectly treated as already confirmed, leading to a premature skip of the addition in the connection table. This trigger initiates a garbage collection that clears the TIME_WAIT entry, reducing the active connection count to zero. As a result, the connlimit module misinterprets the flow and rejects a perfectly valid new connection, effectively denying legitimate traffic. The flaw is specific to soft-limiting scenarios and is not a traditional authentication or code‑execution vulnerability, but it strongly impacts availability for affected services.

The issue affects all Linux kernel implementations that include the current nf_conncount and connlimit modules. The exact kernel version range is not specified in the advisory; however, the patch was applied in the upstream Linux kernel repository and any kernel build that incorporates commit 69894e5b (or later) will have the fix. Systems running older kernels that do not contain this patch are susceptible.

The CVSS score and EPSS metric are not provided, and the vulnerability is not listed in the CISA KEV catalog, so the measured exploitation likelihood is unknown. Nevertheless, the defect allows a legitimate network client to be denied service simply by reusing a TIME_WAIT socket, a scenario that can be targeted by an attacker who forces repeated connection establishment to a server that enforces connlimit. Attackers could use high‑rate SYN re‑use or flooding traffic to trigger the condition. Given the potential for a denial‑of‑service impact on exposed services, the priority for applying a fix should be high.