CVE-2026-23139

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: update last_gc only when GC has been performed

Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely.

Update the last_gc value only when a GC has been actually performed.

A denial of service condition can occur in the netfilter nf_conncount implementation due to incorrect tracking of the last garbage collection timestamp. The nf_conncount code maintains per bucket accounting lists and uses last_gc to decide when it should perform garbage collection of stale entries. Before this change, last_gc was updated every time a new connection entry was tracked. This meant the timestamp could be refreshed even when garbage collection did not actually run. Under a sufficiently high rate of new connections, an attacker can continuously refresh last_gc and effectively keep the code from ever triggering the real GC path. The result is unbounded growth of the internal conncount list, causing increased CPU overhead and eventually memory exhaustion leading to kernel level denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.