CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconncount: update lastgc only when GC has been performed
Currently lastgc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely.
Update the lastgc value only when a GC has been actually performed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23139?
CVE-2026-23139 is rated as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2026-23139?
To resolve CVE-2026-23139, update your Linux kernel to a version that includes the fix for this vulnerability.
Which versions of Linux are affected by CVE-2026-23139?
CVE-2026-23139 affects Linux kernel versions ranging from 5.19 to 6.1.161, and also includes other versions up to 6.19-rc4.
What impact does CVE-2026-23139 have on system security?
CVE-2026-23139 can potentially lead to discrepancies in connection tracking, which may affect network security features.
Is CVE-2026-23139 exploitable remotely?
CVE-2026-23139 does not directly allow remote exploitation, but improper handling of connections could lead to security issues.