CVE-2026-23139: Linux Kernel Netfilter DOS Vulnerability

CVE-2026-23139 Overview

CVE-2026-23139 is a vulnerability in the Linux kernel's netfilter nf_conncount module that allows the connection tracking list to grow infinitely due to improper garbage collection (GC) timing. The flaw exists because the last_gc timestamp is updated every time a new connection is tracked, regardless of whether garbage collection was actually performed. Under high packet rates, this behavior allows attackers to consistently bypass the garbage collection mechanism.

Critical Impact
With sufficiently high packet rates, attackers can bypass the garbage collection mechanism, causing the connection tracking list to grow infinitely and potentially leading to memory exhaustion and denial of service conditions.

Affected Products

Linux Kernel (multiple versions with netfilter nf_conncount module)
Systems using netfilter connection counting features
Network security appliances and firewalls based on Linux kernel

Discovery Timeline

2026-02-14 - CVE CVE-2026-23139 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23139

Vulnerability Analysis

The vulnerability resides in the nf_conncount module within the Linux kernel's netfilter subsystem. This module is responsible for counting and tracking network connections, commonly used for rate limiting and connection-based access control rules.

The root issue stems from how the garbage collection timing mechanism works. The module maintains a last_gc timestamp that is intended to track when the last garbage collection cycle occurred. However, the implementation incorrectly updates this timestamp every time a new connection is tracked, not when garbage collection is actually executed.

Under normal traffic conditions, this flaw may go unnoticed as garbage collection cycles occur frequently enough to clean up stale entries. However, when the system experiences high packet rates—either through legitimate heavy traffic or a deliberate attack—the constant updating of last_gc prevents the garbage collection threshold from ever being reached.

Root Cause

The fundamental issue is an incorrect timing update in the connection tracking logic. The last_gc variable serves as a gatekeeper to determine when garbage collection should run, typically based on elapsed time since the last cleanup. By updating this timestamp on every new connection rather than only after actual garbage collection execution, the code creates a race condition where high-frequency connection events perpetually reset the GC timer before cleanup can occur.

Attack Vector

An attacker can exploit this vulnerability by generating a sustained high rate of network packets that trigger connection tracking. This prevents the garbage collection mechanism from executing, causing the internal connection list to accumulate entries indefinitely. The attack does not require authentication and can be performed remotely over the network.

The exploitation scenario involves flooding the target system with network traffic at a rate sufficient to keep the last_gc timestamp continuously updated. As the connection list grows without bounds, the system will eventually experience memory exhaustion, degraded performance, or complete denial of service.

Detection Methods for CVE-2026-23139

Indicators of Compromise

Abnormally high memory usage in kernel space related to netfilter or connection tracking
Growing connection tracking table entries without corresponding cleanup
System performance degradation under sustained network traffic
Kernel warnings or OOM (Out of Memory) killer events related to netfilter modules

Detection Strategies

Monitor kernel memory consumption for unexpected growth patterns, particularly in netfilter-related allocations
Track connection tracking table size using conntrack -C or examining /proc/sys/net/netfilter/nf_conntrack_count
Implement alerting for sustained high packet rates that could trigger the vulnerability
Review system logs for netfilter-related warnings or memory pressure events

Monitoring Recommendations

Deploy continuous monitoring for kernel memory allocation patterns in production environments
Set thresholds for connection tracking table growth rates and alert on anomalies
Monitor network interface statistics for unusual traffic patterns that could indicate exploitation attempts
Implement periodic health checks on netfilter subsystem memory utilization

How to Mitigate CVE-2026-23139

Immediate Actions Required

Update the Linux kernel to a patched version that addresses the last_gc timing issue
Consider implementing rate limiting at the network perimeter to reduce packet rates reaching vulnerable systems
Monitor affected systems for signs of memory exhaustion or connection table growth
Review firewall rules to minimize unnecessary connection tracking where possible

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches to address this vulnerability. The fix ensures that the last_gc value is only updated when garbage collection has actually been performed, preventing the bypass condition under high packet rates.

Patches are available through the following kernel commits:

Workarounds

Implement network-level rate limiting to prevent extremely high packet rates from reaching the kernel
Reduce the connection tracking hash table size to limit maximum memory impact
Disable nf_conncount module if connection counting features are not required
Use external firewall appliances to handle connection tracking for high-traffic scenarios

bash

# Configuration example
# Limit connection tracking table size as a temporary mitigation
echo 65536 > /proc/sys/net/netfilter/nf_conntrack_max

# Monitor current connection count
cat /proc/sys/net/netfilter/nf_conntrack_count

# If nf_conncount is not required, consider unloading the module
modprobe -r nf_conncount