CVE-2026-72418

A flaw was found in the Linux kernel's netfilter connection tracking module. When a new network connection attempts to reuse a socket that is in a temporary waiting state after closing, the system incorrectly identifies it as an already confirmed connection. This misidentification causes the connection limiting feature to drop valid network packets, leading to a denial of service where legitimate connections are falsely rejected by a remote attacker.

A moderate-impact denial-of-service flaw was found in the Linux kernel's netfilter connection counting (nf_conncount) code, which backs the connlimit feature used by iptables xt_connlimit and nftables nft_connlimit rules. A regression in this code causes packets for valid connections to be dropped when connlimit is used for soft-limiting: when a new connection reuses a socket that is in the TIME_WAIT state, its connection tracking entry is evaluated as already confirmed, the connection is skipped from being added to the count, and a subsequent garbage collection run removes the old TIME_WAIT entry. The active connection count then drops to zero, which xt_connlimit mishandles by falsely rejecting the new, legitimate connection. A remote attacker who can reach a service protected by a connlimit rule can trigger this behavior through normal connection attempts, causing a denial of service in which valid new connections are rejected; there is no impact to confidentiality or integrity.

Within Red Hat's product portfolio, only the kernel in Red Hat Enterprise Linux 10.3 contains this regression; other Red Hat Enterprise Linux streams and Red Hat In-Vehicle OS versions do not contain the vulnerable code and are therefore not affected. The fix for the affected RHEL 10.3 stream has been deferred to a future update. Because the flaw is an availability-only regression that requires administrator-configured connlimit rules to be in use, the residual risk is limited to systems with such rules: legitimate connections that reuse TIME_WAIT sockets may be falsely dropped, reducing the availability of the protected service, but the flaw does not allow memory corruption, privilege escalation, or any impact beyond connection rejection.

The upstream CVE record rates this flaw as important (CVSS 3.1 score 7.5, network attack vector, no privileges required), while Red Hat rates it moderate (CVSS 3.1 score 5.5): successful exploitation depends on administrator-configured connlimit rules and on connection-reuse timing, and the consequence is limited to the availability of connections matched by those rules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.