diff -druNp --no-dereference linux-libre-3.17.5-gnu/Makefile linux-libre-3.17.6-gnu/Makefile
--- linux-libre-3.17.5-gnu/Makefile	2014-12-07 04:37:38.000000000 -0500
+++ linux-libre-3.17.6-gnu/Makefile	2014-12-07 15:19:08.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 17
-SUBLEVEL = 5
+SUBLEVEL = 6
 EXTRAVERSION =-gnu
 NAME = Shuffling Zombie Juror
 
diff -druNp --no-dereference linux-libre-3.17.5-gnu/net/netfilter/nf_conntrack_core.c linux-libre-3.17.6-gnu/net/netfilter/nf_conntrack_core.c
--- linux-libre-3.17.5-gnu/net/netfilter/nf_conntrack_core.c	2014-12-06 18:57:59.000000000 -0500
+++ linux-libre-3.17.6-gnu/net/netfilter/nf_conntrack_core.c	2014-12-07 14:48:01.000000000 -0500
@@ -611,16 +611,12 @@ __nf_conntrack_confirm(struct sk_buff *s
 	 */
 	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 	pr_debug("Confirming conntrack %p\n", ct);
-
-	/* We have to check the DYING flag after unlink to prevent
-	 * a race against nf_ct_get_next_corpse() possibly called from
-	 * user context, else we insert an already 'dead' hash, blocking
-	 * further use of that particular connection -JM.
-	 */
-	nf_ct_del_from_dying_or_unconfirmed_list(ct);
+	/* We have to check the DYING flag inside the lock to prevent
+	   a race against nf_ct_get_next_corpse() possibly called from
+	   user context, else we insert an already 'dead' hash, blocking
+	   further use of that particular connection -JM */
 
 	if (unlikely(nf_ct_is_dying(ct))) {
-		nf_ct_add_to_dying_list(ct);
 		nf_conntrack_double_unlock(hash, reply_hash);
 		local_bh_enable();
 		return NF_ACCEPT;
@@ -640,6 +636,8 @@ __nf_conntrack_confirm(struct sk_buff *s
 		    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
 			goto out;
 
+	nf_ct_del_from_dying_or_unconfirmed_list(ct);
+
 	/* Timer relative to confirmation time, not original
 	   setting time, otherwise we'd get timer wrap in
 	   weird delay cases. */
