CVE-2026-72247 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conncount: fix zone comparison in tuple dedup
The "already exists" dedup logic in __nf_conncount_add() decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. It compares the conntrack zone of a list entry with the zone of the connection being added using nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or zone->dir as the direction argument.
Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0 and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask: NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction shifts the meaning of every non-zero value. An ORIG-only zone passes 1 and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and test bits beyond the valid direction range. In those cases nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using the real zone id, so different zones can be treated as equal and dedup collapses to tuple equality alone.
nf_conncount stores and compares the original-direction tuple for a connection. If an skb already has an attached conntrack entry, get_ct_or_tuple_from_skb() explicitly copies ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's
ctinfo. Therefore the zone comparison in the tuple dedup path must use IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a zone id applies, not which direction this conncount tuple represents.
Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly. Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional zone contains the ORIG bit, so it naturally returns the real zone id; reply-only zones continue to fall back for original-direction tuple comparisons.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's netfilter subsystem, specifically within the nf_conncount module responsible for connection limiting. This flaw affects how connection tracking zones are compared during tuple deduplication processes, creating a potential bypass mechanism that could allow malicious actors to circumvent connection limits imposed by firewall rules. The issue stems from an incorrect handling of zone direction identifiers when comparing existing connections against new ones being added to the system.
The technical root cause involves a fundamental mismatch between data types used in zone comparison operations. The nf_ct_zone_id() and nf_ct_zone_equal() helper functions expect enum ip_conntrack_dir values where IP_CT_DIR_ORIGINAL equals 0 and IP_CT_DIR_REPLY equals 1. However, the zone->dir field contains u8 bitmask values with NF_CT_ZONE_DIR_ORIG set to 1, NF_CT_ZONE_DIR_REPL set to 2, and NF_CT_DEFAULT_ZONE_DIR set to 3. This type mismatch causes incorrect interpretation of zone directions, effectively transforming ORIG-only zones into REPLY comparisons and making REPL-only or default zones compare against invalid bit positions beyond the valid direction range.
When these incorrect comparisons occur, the nf_ct_zone_id() function can fall back to NF_CT_DEFAULT_ZONE_ID instead of utilizing the actual zone identifier. This fallback mechanism creates situations where distinct zones are incorrectly treated as identical, reducing the deduplication logic to simple tuple equality checks rather than proper zone-aware comparisons. The consequence is that connections from different zones may be considered duplicates when they should be counted separately, allowing attackers to bypass connection limits through carefully crafted network traffic patterns.
The operational impact of this vulnerability extends beyond simple connection counting failures and could enable denial-of-service scenarios or circumvention of security policies designed to limit concurrent connections per zone. Attackers could exploit this weakness to exhaust connection limits more rapidly than intended by manipulating packet flow characteristics that trigger the incorrect zone comparison logic. The vulnerability affects systems running Linux kernels with netfilter functionality, particularly those implementing connection tracking zones for traffic management and security enforcement.
The fix implemented addresses the core comparison issue by explicitly passing IP_CT_DIR_ORIGINAL directly to the deduplication functions instead of relying on potentially corrupted zone direction values. This approach maintains compatibility with existing helper functions while ensuring proper zone identification through the natural fallback behavior that preserves direction-aware zone ID resolution. The solution avoids special-casing NF_CT_DEFAULT_ZONE_DIR and eliminates direct raw zone ID comparisons, which were contributing to the incorrect behavior. By using the existing helpers with IP_CT_DIR_ORIGINAL, the implementation properly handles default bidirectional zones that naturally contain ORIG bits while maintaining correct fallback behavior for reply-only zones during original-direction tuple comparisons.
This vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write categories in the Common Weakness Enumeration system, representing improper handling of zone direction semantics within connection tracking operations. The mitigation strategy follows ATT&CK technique T1070.004 Indicator Removal on Host to prevent detection of unusual connection patterns that might otherwise reveal the vulnerability's exploitation. The fix ensures that nf_conncount maintains proper zone-aware tuple deduplication while preserving the expected behavior of connection limiting mechanisms throughout the Linux kernel's netfilter infrastructure.
The correction maintains backward compatibility while strengthening security controls around connection tracking zones, ensuring that systems properly enforce connection limits based on actual zone configurations rather than being susceptible to bypasses through incorrect zone direction handling. This resolution addresses a critical gap in network traffic management that could have enabled attackers to circumvent established security policies and resource limitations implemented through kernel-based connection tracking systems.