In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
was skipped") introduced a regression where packets for valid
connections are dropped when using connlimit for soft-limiting
scenarios.

The issue occurs when a new connection reuses a socket currently in
the TIME_WAIT state. In this scenario, the connection tracking entry
is evaluated as already confirmed. Previously, __nf_conncount_add()
assumed that if a connection was confirmed and did not originate from
the loopback interface, it should skip the addition and return -EEXIST.

Skipping the addition triggers a garbage collection run that cleans up
the TIME_WAIT connection. Consequently, the active connection count
drops to 0, which xt_connlimit mishandles, leading to the false rejection
of the perfectly valid new connection.

Fix this by replacing the interface check with protocol-agnostic state
checks. We now skip the tree insertion and preserve the lockless garbage
collection optimization only if the connection is IPS_ASSURED. This
allows early-confirmed setup packets (such as reused TIME_WAIT sockets
or locally generated SYN-ACKs) to be properly evaluated and counted
without falsely dropping. The goto check_connections path is maintained
to ensure these setup packets are deduplicated correctly.

This has been tested with slowhttptest and HTTP server configured
locally to ensure we are not breaking soft-limiting scenarios for local
or external connections. In addition, it was tested with a OVS zone
limit too.

https://git.kernel.org/stable/c/000ac6830b56499d6b65fd91486ce6689eb02be4

https://git.kernel.org/stable/c/329f2626ee5cb8fafdf6b58b624311529c57cb45

https://git.kernel.org/stable/c/3793d24de224943e0a6016bbeffb6f5c4cea2e3d

https://git.kernel.org/stable/c/abef7f817217fcb62c11821d6b895063eadb2828

https://git.kernel.org/stable/c/be52572c6d55f677ba76869d3c63805c0d4891a3

https://git.kernel.org/stable/c/c8b6f36f766991e3ebebec6596daee4b04dcbc49

https://git.kernel.org/stable/c/cbe2d14a7c5b1fc71821fbfee5c4963917411e92

https://git.kernel.org/stable/c/ebfe8249ba79e4ff0f1e3aad8787b992ef27f026

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_conncount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"460c112e1d887b58b06b56e8e0230058906ff2c3","lessThan":"000ac6830b56499d6b65fd91486ce6689eb02be4","versionType":"git","status":"affected"},{"version":"53bc0ac47f4f7621c991807bc90e01df49561ac8","lessThan":"cbe2d14a7c5b1fc71821fbfee5c4963917411e92","versionType":"git","status":"affected"},{"version":"ca8b4d1d6304a84ce2016fa2fe9a114b9607b839","lessThan":"3793d24de224943e0a6016bbeffb6f5c4cea2e3d","versionType":"git","status":"affected"},{"version":"8286c02fe9100330475331253fc590f047963f90","lessThan":"abef7f817217fcb62c11821d6b895063eadb2828","versionType":"git","status":"affected"},{"version":"b29ddccf36946a90323486221f39e9f88cc01b8e","lessThan":"ebfe8249ba79e4ff0f1e3aad8787b992ef27f026","versionType":"git","status":"affected"},{"version":"77ea3d8ac3d3d59b5ac9ad639e4ba107c0f2ff1e","lessThan":"329f2626ee5cb8fafdf6b58b624311529c57cb45","versionType":"git","status":"affected"},{"version":"69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e","lessThan":"be52572c6d55f677ba76869d3c63805c0d4891a3","versionType":"git","status":"affected"},{"version":"69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e","lessThan":"c8b6f36f766991e3ebebec6596daee4b04dcbc49","versionType":"git","status":"affected"},{"version":"f85623af16b83615e5f64a9b19ae1d584805cb07","versionType":"git","status":"affected"},{"version":"5.10.248","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.198","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.160","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.120","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.63","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.18.2","lessThan":"6.18.40","versionType":"semver","status":"affected"},{"version":"6.17.13","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_conncount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]