The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: nf_conncount: fix zone comparison in tuple dedup The already exists dedup logic in
    __nf_conncount_add() decides whether a connection has already been counted and can be skipped instead of     incrementing the connlimit count. It compares the conntrack zone of a list entry with the zone of the     connection being added using nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or zone->dir     as the direction argument. Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0 and     IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask: NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is     2 and NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction shifts the meaning of every     non-zero value. An ORIG-only zone passes 1 and is tested as REPLY, while REPL-only and default zones pass     2 or 3 and test bits beyond the valid direction range. In those cases nf_ct_zone_id() can fall back to     NF_CT_DEFAULT_ZONE_ID instead of using the real zone id, so different zones can be treated as equal and     dedup collapses to tuple equality alone. nf_conncount stores and compares the original-direction tuple for     a connection. If an skb already has an attached conntrack entry, get_ct_or_tuple_from_skb() explicitly     copies ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's ctinfo. Therefore the zone     comparison in the tuple dedup path must use IP_CT_DIR_ORIGINAL as well; the zone direction bitmask     describes where a zone id applies, not which direction this conncount tuple represents. Fix the two dedup     comparisons by passing IP_CT_DIR_ORIGINAL directly. Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not     compare raw zone ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the direction-aware     NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional zone contains the ORIG bit, so it naturally     returns the real zone id; reply-only zones continue to fall back for original-direction tuple comparisons.
    (CVE-2026-72247)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72247

high Nessus Plugin ID 337590

Version 1.4