CVE-2026-72247

A flaw was found in the Linux kernel's netfilter nf_conncount component. An incorrect comparison of conntrack zones in the connection counting logic can cause different zones to be treated as equal. This miscalculation in connection deduplication may lead to connection limits not being properly enforced, potentially resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because it requires a specific firewall configuration utilizing connection limit rules alongside multiple conntrack zones, which is not enabled by default in Red Hat Enterprise Linux. When distinct connection tracking zones share identical network tuples, the connection counter can incorrectly treat them as duplicates, resulting in improper enforcement of configured connection limits. The flaw does not lead to memory corruption or arbitrary code execution, and exploitation is constrained to bypassing intended connection thresholds on systems actively utilizing zone-based connection filtering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.