Security readout for executives and security teams
Plain-English summary
A Linux netfilter connection-counting flaw can prevent cleanup during sustained high packet rates. The tracked-connection list may then grow without bound, exhausting resources and disrupting service. The supplied CVSS score is 7.5, reflecting remotely triggerable availability impact without privileges or user interaction.
Executive priority
Treat as a high-priority availability risk for exposed Linux firewalls, gateways, and servers using the affected function. Patch promptly after normal compatibility testing, with fastest attention to systems receiving untrusted high-volume traffic. Evidence supplied does not justify an emergency active-exploitation declaration.
Technical view
In nf_conncount, last_gc was updated whenever a connection was tracked, even when garbage collection did not run. Sufficiently frequent traffic could continually defer collection, allowing the internal list to grow indefinitely. The referenced stable-kernel commits change last_gc updates to occur only after garbage collection is performed.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel and using nf_conncount for traffic reachable at high packet rates. The bundle lists affected kernel versions, but distribution kernels may backport fixes; assess package builds against vendor advisories or referenced commits rather than version numbers alone.
Exploitation context
The condition is network reachable, low complexity, requires no privileges or user interaction, and affects availability. The supplied record says KEV is false and provides no evidence of active exploitation. Absence from KEV does not establish that exploitation has never occurred.
Researcher notes
The failure is a garbage-collection timing defect rather than a confidentiality or integrity issue. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Precise affected ranges and distribution backports are not fully resolved by the bundle, so commit-level or vendor-package verification is important.
Mitigation direction
- Install a distribution kernel containing the applicable referenced nf_conncount fix.
- Check Linux distribution advisories for backported-fix and reboot requirements.
- Prioritize internet-facing systems using netfilter connection-counting rules.
- Until patched, apply appropriate upstream traffic controls to limit sustained abusive packet rates.
Validation and detection
- Inventory running kernel builds and compare them with distribution security advisories.
- Verify the installed kernel contains the applicable referenced stable commit or documented backport.
- Review netfilter configuration for connection-counting rules using nf_conncount.
- Confirm systems booted into the remediated kernel after package installation.
- Monitor exposed systems for abnormal resource growth and availability degradation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23139 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34fCVE reference, Linux
- https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1CVE reference, Linux
- https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811CVE reference, Linux
- https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3CVE reference, Linux
- https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35CVE reference, Linux
- https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101aCVE reference, Linux
- https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.