Linux Kernel CVE-2026-45897

Netfilter is the Linux kernel's core packet filtering and NAT framework, and nft_counter is a native nftables counter object used to accumulate per-rule packet and byte statistics. The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) race condition: the 'dump-and-reset' operation - which fetches the current running total across per-CPU counter shards and then zeroes them - was not serialized. Two threads executing this operation concurrently could both observe the same pre-reset total, then both issue the subtraction, leaving the counter in an underrun state. Because these are likely unsigned 64-bit integers, underflow wraps to a very large value. The fix introduces a global static spinlock around the fetch-then-reset critical section. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. CWE was not formally assigned in NVD, but this maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) and CWE-191 (Integer Underflow).