CVE-2026-23139

What it actually does

The flaw in nf_conncount updates the last_gc timestamp on every new tracked connection even when no garbage collection occurs, allowing high packet rates to perpetually bypass GC and cause the connection list to grow without bound.

Why it matters to the business

Linux-based network devices and servers may suffer memory exhaustion and denial of service under sustained high traffic, disrupting network operations with moderate urgency given the 254 days since publication and slight EPSS rise.

How an attack unfolds

An attacker sends packets at a sufficiently high rate to force repeated connection tracking updates that refresh last_gc without ever executing GC, resulting in unbounded list growth and resource depletion.

How to fix it

Upgrade the Linux kernel to include commit 2c7c71113ed6d3e2f3aca4c088f22283016ff34f in the stable tree.

How to confirm the fix worked

Inspect kernel source or git history for the presence of commit 2c7c71113ed6d3e2f3aca4c088f22283016ff34f; confirm nf_conncount last_gc logic updates only after actual GC runs.

Typical attack path

1. Establish high-rate packet flow targeting netfilter connection tracking
2. Ensure each packet triggers tracking entry creation without allowing GC execution window
3. Sustain rate to prevent last_gc from triggering cleanup
4. Observe unbounded memory growth leading to DoS

How to detect it

Review system logs and memory metrics for sustained high conntrack list growth uncorrelated with legitimate traffic volume; examine netfilter module behavior under load.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems
• Monitor conntrack memory usage and connection list sizes
• Apply network rate limiting as temporary mitigation if immediate patching is not feasible