CVE-2025-71146: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71146 is a memory leak (resource leak) vulnerability in the Linux kernel's netfilter nf_conncount module. The flaw occurs when connection tracking (ct) objects are not properly dereferenced in certain error paths, causing memory to be leaked rather than released. It was published on January 23, 2026, and affects Linux kernel versions 6.17.13 through 6.18 (exclusive), as well as specific versions 6.12.63, 6.18.2, and 6.19-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). Within the nf_conncount netfilter module, certain error paths bypass the reference count check and return immediately without decrementing the ct object's reference count, causing the object to remain allocated indefinitely. The fix ensures the refcounted check is always invoked regardless of the code path taken. Exploitation requires local access with low privileges and low complexity, as an attacker must be able to trigger the error conditions in the netfilter subsystem (Red Hat Advisory, Feedly).

Successful exploitation allows a local attacker with low privileges to repeatedly trigger the error conditions in the nf_conncount module, causing progressive memory exhaustion on the host system. On high-traffic systems or those handling many concurrent network connections, this can lead to denial of service through system unresponsiveness or crash. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to a patched kernel version that includes the fixes committed to the Linux kernel repository (patch commits: 08fa37f4, 0b88be72, 2e2a7207, 325eb61b, 4bd2b89f, e1ac8dce, f381a33f). As a short-term workaround, restrict local user access to systems running vulnerable kernel versions and monitor system memory usage for unexpected depletion. Apply kernel updates as soon as patches are available for the specific kernel branch in use (Red Hat Advisory, kernel.org patches).