CVE-2026-72247

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter nf conncount component regarding zone comparison during tuple deduplication. The deduplication logic in the nf conncount add() function incorrectly uses a u8 bitmask from zone->dir as an argument for nf ct zone id() and nf ct zone equal(), which expect enum ip conntrack dir values. This mismatch causes non-zero values to be misinterpreted, potentially leading nf ct zone id() to fall back to NF CT DEFAULT ZONE ID instead of using the actual zone ID. Consequently, different zones may be treated as equal, causing the deduplication process to rely solely on tuple equality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.