Skip to main content

Linux Kernel CVE-2026-45859

| EUVDEUVD-2026-32325 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-v8w5-25mx-q5r4
Denial Of Service Linux
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify host running nfqueue without F_GSO
  2. Delivery
    Send UDP flood to nfqueue-targeted port
  3. Exploit
    GRO aggregates packets into GSO superpacket
  4. Install
    Kernel segments skb, inflating conntrack refcount
  5. C2
    nf_ct_drop_unconfirmed drops every segment
  6. Execute
    Userspace handler never receives traffic
  7. Impact
    Service availability degraded

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target Linux host must (1) run an nfqueue userspace application that did NOT set the NFQA_CFG_F_GSO capability flag at queue configuration, (2) have nftables/iptables rules that NFQUEUE-target UDP traffic, (3) receive UDP traffic that GRO aggregates into GSO superpackets, and (4) be processing flows whose nf_conn conntrack entry is still in the unconfirmed state when the packet reaches the queue. The flaw is UDP-specific (TCP SYNs are not GRO-aggregated per the commit message) and impact is limited to availability of the nfqueue-mediated service path - confidentiality and integrity are unaffected. Hosts not using nfqueue, or whose userspace handler already negotiates F_GSO, are not exploitable.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reports a network-reachable, unauthenticated, low-complexity availability-only flaw, scoring 7.5. However, EPSS is 0.02% (5th percentile), the CVE is not in CISA KEV, and no POC has been published - all signals point to negligible active exploitation risk. The CVSS network vector is technically defensible (a remote sender can send UDP packets that traverse an nfqueue ruleset) but the real-world impact is narrow: it only manifests on hosts running an nfqueue userspace handler that did NOT negotiate NFQA_CFG_F_GSO, processing GRO-aggregated UDP traffic with unconfirmed conntrack state. This is a functional regression that breaks legitimate nfqueue userspace applications more than it offers attackers a useful DoS primitive against arbitrary targets. CWE is not assigned in the input. Treat this as a stability/regression fix to roll out on the normal kernel update cadence rather than an emergency patch.
Exploit ScenarioDerived

A remote sender transmits a burst of UDP datagrams toward a Linux host whose ruleset diverts traffic into an nfqueue userspace handler that has not enabled the F_GSO capability flag. GRO aggregates the incoming UDP into superpackets with unconfirmed conntrack state, and the kernel drops every segment instead of queueing it, preventing the userspace policy from ever seeing the flow and causing service disruption. No public exploit identified at time of analysis; the trigger requires a specific deployment configuration rather than a generic network primitive.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Denial of service in the Linux kernel's netfilter nfnetlink_queue subsystem allows remote attackers to cause packet drops affecting availability when nfqueue is used without the NFQA_CFG_F_GSO capability flag. The flaw is a regression where the shared-unconfirmed conntrack check was performed after skb_gso_segment(), causing GSO UDP packets associated with unconfirmed nf_conn entries to be dropped instead of queued. EPSS is very low (0.02%) with no public exploit identified at time of analysis and no CISA KEV listing, indicating low real-world urgency despite the CVSS 7.5 availability score.

RemediationAI

Vendor-released patch: Linux kernel 6.12.75, 6.18.14, and 6.19.4 (per EUVD), with upstream commits 207b3eba, 23901aa6, 79b713ef, and b740e7dd available at git.kernel.org/stable/c/ - apply the distribution kernel update that incorporates these backports for the 5.15.y, 6.1.y, 6.6.y, 6.10.y, 6.12.y, 6.18.y, and 6.19.y series. As a workaround until the patch is deployed, update the nfqueue userspace handler to set the NFQA_CFG_F_GSO capability flag during configuration so the kernel queues GSO superpackets directly and bypasses the buggy segmentation path; the trade-off is that the userspace handler must then be able to parse and act on aggregated GSO skbs rather than per-segment packets. Alternatively, disable GRO on the receiving interface with 'ethtool -K <iface> gro off', accepting the per-packet CPU overhead that GRO normally amortizes. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-45859.

Affected VersionsENISA

Linux 6.1.107 <6.2
Linux 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb <207b3ebacb6113acaaec0d171d5307032c690004
Linux patch: 0
Linux 5.15.166 <5.16
Linux patch: 7.0
Linux 025b3326c5c409b372d0103ad30f174e55adbd1b
Linux 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0
Linux 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86
Linux 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3
Linux 6.6.48 <6.7
Linux 6.11
Linux patch: 6.18.14
Linux 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb <23901aa6b8a2f294c4b774436b4691f3ff863a8f
Linux 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb <79b713ef4261a8ead96af4703f89d0b5f25532e2
Linux 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb <b740e7ddd7ca0dbfeafca3f5e52717206cf28524
Linux 6.10.7 <6.11
Linux patch: 6.19.4
Linux patch: 6.12.75

Affected Packages

euvd linux fix: 5.16, 6.2, 6.7, 6.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in net/netfilter/nfnetlink_queue.c, the kernel component that hands packets to userspace queue handlers (nfqueue) for filtering decisions. When userspace does not negotiate the NFQA_CFG_F_GSO flag, the kernel must segment Generic Segmentation Offload (GSO) aggregated packets via skb_gso_segment() before queueing. That segmentation calls skb_clone(), which raises the skb and associated nf_conn (connection tracking) reference counts. The pre-existing nf_ct_drop_unconfirmed() check, intended to prevent queueing of skbs whose conntrack entry is still unconfirmed and shared, ran after segmentation - so every cloned segment appeared shared and was dropped. The fix moves the check ahead of segmentation against the aggregated skb and annotates segments so a second check at reinject time still catches genuinely shared entries. The condition only triggers for UDP (TCP SYNs, the only unconfirmed TCP packets, are not GRO-aggregated).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.5 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:16 nvd
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Ulrich reports a regression with nfqueue:

If an application did not set the 'F_GSO' capability flag and a gso packet with an unconfirmed nf_conn entry is received all packets are now dropped instead of queued, because the check happens after skb_gso_segment(). In that case, we did have exclusive ownership of the skb and its associated conntrack entry. The elevated use count is due to skb_clone happening via skb_gso_segment().

Move the check so that its peformed vs. the aggregated packet.

Then, annotate the individual segments except the first one so we can do a 2nd check at reinject time.

For the normal case, where userspace does in-order reinjects, this avoids packet drops: first reinjected segment continues traversal and confirms entry, remaining segments observe the confirmed entry.

While at it, simplify nf_ct_drop_unconfirmed(): We only care about unconfirmed entries with a refcnt > 1, there is no need to special-case dying entries.

This only happens with UDP. With TCP, the only unconfirmed packet will be the TCP SYN, those aren't aggregated by GRO.

Next patch adds a udpgro test case to cover this scenario.

Executive ViewAI

Why It Matters

A Linux kernel netfilter vulnerability (CVE-2026-45859) causes packet drops in UDP traffic processed through nfqueue, affecting organizations that rely on kernel packet queueing for security filtering or network packet processing. Despite a HIGH CVSS score, real-world risk is substantially lower-no public exploits exist, EPSS is 0.02%, and no active exploitation has been observed.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45859 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/366117 REF https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004 REF https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f REF https://git.kernel.org/stable/c/4666688657e1054278b836b825fb88b2907e2da2 REF https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2 REF https://git.kernel.org/stable/c/aead84bdacd77e08357fd718e5dcaffaf387f3c3 REF https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy