Skip to main content

Linux Kernel CVE-2026-45897

| EUVDEUVD-2026-32363 MEDIUM
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4c46-9f7j-r9vq
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.6 LOW

Race condition requires precise timing (AC:H); counter corruption affects integrity and minor availability but causes no crash or privilege escalation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
3.6 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 21:34 vuln.today
CVSS changed
Jun 25, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_counter: serialize reset with spinlock

Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values.

The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them.

A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.

AnalysisAI

Counter value underrun in the Linux kernel's netfilter nft_counter subsystem allows a local unprivileged user to corrupt nftables packet and byte counter data through a race condition in concurrent dump-and-reset operations. Two parallel resets can each read the same counter totals and both subtract them, causing the counters to underrun - potentially wrapping unsigned values to astronomically large figures and producing incorrect firewall accounting. No public exploit exists and EPSS is 0.02% (5th percentile), consistent with a low-priority correctness defect rather than a targeted security attack vector.

Technical ContextAI

Netfilter is the Linux kernel's core packet filtering and NAT framework, and nft_counter is a native nftables counter object used to accumulate per-rule packet and byte statistics. The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) race condition: the 'dump-and-reset' operation - which fetches the current running total across per-CPU counter shards and then zeroes them - was not serialized. Two threads executing this operation concurrently could both observe the same pre-reset total, then both issue the subtraction, leaving the counter in an underrun state. Because these are likely unsigned 64-bit integers, underflow wraps to a very large value. The fix introduces a global static spinlock around the fetch-then-reset critical section. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. CWE was not formally assigned in NVD, but this maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) and CWE-191 (Integer Underflow).

RemediationAI

The primary fix is to update to a patched Linux kernel version: 6.19.4 or 7.0 per EUVD data, with stable-branch patches accessible via the kernel stable git at https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e and https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f15a43526841b679445c32e2. Distribution vendors (RHEL, Debian, Ubuntu, SUSE) typically backport these stable commits into their own kernel packages; administrators should apply the latest kernel update from their distribution's security channels. As a compensating control, environments that do not use nftables counter objects can avoid exposure entirely by auditing nftables rulesets and removing unnecessary counter statements - this eliminates the vulnerable code path without kernel upgrade. Note that disabling all counters may reduce firewall observability. No reboot-free mitigations are available for live systems without a kernel patch.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-45897 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy