CVE-2026-23139

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23139
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely. Update the last_gc value only when a GC has been actually performed.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35 Patch
https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f Patch
https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3 Patch
https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c Patch
https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a Patch
https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811 Patch
https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
History

17 Mar 2026, 21:14

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35 - () https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35 - Patch
References () https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f - () https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f - Patch
References () https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3 - () https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3 - Patch
References () https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c - () https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c - Patch
References () https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a - () https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a - Patch
References () https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811 - () https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811 - Patch
References () https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1 - () https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: nf_conncount: actualizar last_gc solo cuando se ha realizado la GC Actualmente, last_gc se actualiza cada vez que se rastrea una nueva conexión, lo que significa que se actualiza incluso si no se realizó una GC. Con una tasa de paquetes suficientemente alta, es posible eludir siempre la GC, haciendo que la lista crezca infinitamente. Actualizar el valor de last_gc solo cuando se ha realizado realmente una GC.

14 Feb 2026, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 16:15

Updated : 2026-03-17 21:14

NVD link : CVE-2026-23139

Mitre link : CVE-2026-23139

CVE.ORG link : CVE-2026-23139

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo