HarborGuard / CVE
Back to search
HIGHCVE-2026-23139Published Modified CNA Linux

CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely. Update the last_gc value only when a GC has been actually performed.

Metrics

CVSS v3.1
7.5
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

026a82dce2beee39c43c109d9647e16f49cb02a352c7c71113ed6d3e2f3aca4c088f22283016ff34f3cd717359e56f82f06cbf8279b47a7d79880c6f36.1.1616.6.1216.12.666.18.66.197811ba452402d58628e68faedf38745b3d485e3c8bdafdf4900040a81422056cabe5e00a37bd101a9f45588993d7f115280fc726119ca86fba32a811c4cde57c8affdcca5bcff53a1047e15d268bdca1
Affected packages
  • Linux / Linux
    < 2c7c71113ed6d3e2f3aca4c088f22283016ff34f (from f106694733c66a48740c25bc4e212e9b2ea364ce) · < c4cde57c8affdcca5bcff53a1047e15d268bdca1 (from be69850b461e7b491d87a22e33ab76fdd04b725e) · < 9f45588993d7f115280fc726119ca86fba32a811 (from d265929930e2ffafc744c0ae05fb70acd53be1ee) · < 3cd717359e56f82f06cbf8279b47a7d79880c6f3 (from d265929930e2ffafc744c0ae05fb70acd53be1ee) · < 26a82dce2beee39c43c109d9647e16f49cb02a35 (from d265929930e2ffafc744c0ae05fb70acd53be1ee) · < 8bdafdf4900040a81422056cabe5e00a37bd101a (from d265929930e2ffafc744c0ae05fb70acd53be1ee)
  • Linux / Linux
    5.19
    Fixed in 0, 6.1.161, 6.6.121, 6.12.66, 6.18.6, 6.19
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References