Linux Kernel CVE-2026-45860

Vendor-released patches are available - upgrade to a fixed stable kernel: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, or 7.0 (or later), pulling from your distribution's kernel update channel or rebasing onto the corresponding git.kernel.org/stable commits listed in the NVD references. If immediate kernel update is not possible, compensating controls focus on reducing reliance on nf_conncount under high connection-rate conditions: temporarily remove or relax nft_connlimit/xt_connlimit rules that gate critical services so spurious limit hits do not deny legitimate traffic (trade-off: loses per-source connection-flood protection at that layer), or shift connection-limit enforcement upstream to a load balancer, reverse proxy, or stateful firewall appliance that is not affected (trade-off: added latency and a new policy surface to maintain); for OVS deployments, lower the configured connection ceiling well below the rate at which the bug manifests, or rate-limit new flows with meter/policer actions to keep additions per jiffy under the threshold (trade-off: reduces peak legitimate throughput). Increasing CONFIG_HZ also shortens the jiffy window and indirectly raises the effective per-second cap, but requires a kernel rebuild and has system-wide scheduling implications.