Executive brief
A vulnerability exists in the Linux kernel's networking subsystem, specifically within the Netfilter connection counting component. This component is responsible for tracking and limiting the number of simultaneous network connections. An exploit could lead to a memory leak, potentially causing system instability or a denial-of-service condition that disrupts network operations.
Technical details
A memory leak vulnerability (CWE-401) exists in the nf_conncount.c component of the Linux kernel's Netfilter subsystem. The issue stems from error paths in the __nf_conncount_add and related functions that skip necessary reference count checks, failing to release connection tracking (ct) objects. A remote attacker could potentially trigger these error paths to exhaust system memory, leading to a denial-of-service (DoS). The vulnerability has been addressed by ensuring that nf_ct_put is consistently called in all exit paths when a reference is held. Patches are available for multiple stable kernel branches including 6.12.y and 6.18.y.
Affected products
- Linux Linux Kernel 6.12.63, 6.17.13 to 6.18, 6.18.2, 6.19-rc1
Timeline
- 2025-12-05: patched: Initial patch authored by Fernando Fernandez Mancera
- 2026-01-23: disclosed: CVE published
References
- https://git.kernel.org/stable/c/08fa37f4c8c59c294e9c18fea2d083ee94074e5a
- https://git.kernel.org/stable/c/0b88be7211d21a0d68bb1e56dc805944e3654d6f
- https://git.kernel.org/stable/c/2e2a720766886190a6d35c116794693aabd332b6
- https://git.kernel.org/stable/c/325eb61bb30790ea27782203a17b007ce1754a67
- https://git.kernel.org/stable/c/4bd2b89f4028f250dd1c1625eb3da1979b04a5e8
- https://git.kernel.org/stable/c/e1ac8dce3a893641bef224ad057932f142b8a36f
- https://git.kernel.org/stable/c/f381a33f34dda9e4023e38ba68c943bca83245e9