CVE-2026-23139: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23139 is a denial-of-service vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_conncount module, caused by improper garbage collection (GC) timestamp management. The flaw allows a low-privileged local attacker to cause unbounded memory growth in the connection tracking list by generating a sufficiently high packet rate, effectively bypassing the GC mechanism. It was published on February 14, 2026, with patches released on March 17, 2026. Affected kernel versions span 5.19 through 6.18.5 across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a logic error (CWE-400: Uncontrolled Resource Consumption) in the nf_conncount module's garbage collection logic. The last_gc timestamp is updated every time a new connection is tracked, regardless of whether a GC cycle was actually executed. Under a high packet rate, the GC interval check is perpetually satisfied by the continuously refreshed timestamp, meaning GC is never triggered and the connection tracking list grows without bound. The fix restricts last_gc updates to only occur when GC has actually been performed, ensuring the GC interval is correctly enforced (Feedly, Kernel Patch).

Successful exploitation results in unbounded kernel memory consumption, leading to denial of service through resource exhaustion. The growing connection tracking list can cause system crashes, service failures, or system-wide instability. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Feedly).

1. Gain local access: Obtain a low-privileged shell on a system running a vulnerable Linux kernel version (5.19–6.18.5).
2. Generate high packet rate: Use a tool such as hping3, iperf, or a custom raw socket program to generate a sustained high-volume stream of network packets that create new connection tracking entries in the nf_conncount module.
3. Bypass garbage collection: The high packet rate causes last_gc to be updated continuously on each new connection, preventing the GC interval threshold from being reached and thus skipping GC execution entirely.
4. Exhaust kernel memory: As the connection tracking list grows without bound, kernel memory is progressively consumed, eventually leading to OOM (out-of-memory) conditions, service crashes, or a full system crash (Feedly).

• System Metrics: Sustained and abnormal growth in kernel memory usage (/proc/meminfo showing rapidly decreasing MemFree/MemAvailable); OOM killer events in kernel logs (dmesg or /var/log/kern.log).
• Logs: Kernel messages indicating memory pressure or OOM kills (oom-kill entries in dmesg); unusual volume of netfilter connection tracking entries visible via conntrack -L | wc -l.
• Network: Abnormally high rate of new connection tracking entries; unusually high packet rates from a local process visible via ss, netstat, or iptables -L -n -v.
• Process: Unexpected high-CPU or high-throughput processes generating network traffic locally (e.g., hping3, custom raw socket tools) (Feedly).

Apply the patched kernel versions released on March 17, 2026: 6.1.161 or later (for 5.19–6.1.x branch), 6.6.121 or later (for 6.2–6.6.x), 6.12.66 or later (for 6.7–6.12.x), and 6.18.6 or later (for 6.13–6.18.x). Red Hat has also issued an errata (RHSA-2026:15883) for affected RHEL systems. As a temporary workaround where patching is not immediately possible, restrict local user access to affected systems, implement rate limiting on incoming connections, and monitor kernel memory usage for anomalies (Feedly, Red Hat Errata).

The vulnerability has been covered by Linux security advisory aggregators including LinuxSecurity.com (Oracle and Ubuntu advisories) and Pro-Linux.de (multiple German-language Linux security bulletins). Tenable has published multiple Nessus detection plugins (IDs: 299224, 301875, 301901, 303406, 304219, 304560, 318847) and pipeline issue trackers for this CVE. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers (LinuxSecurity Oracle, LinuxSecurity Ubuntu).