Skip to main content

Linux Kernel EUVDEUVD-2026-32363

| CVE-2026-45897 MEDIUM
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4c46-9f7j-r9vq
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.6 LOW

Race condition requires precise timing (AC:H); counter corruption affects integrity and minor availability but causes no crash or privilege escalation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
3.6 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 21:34 vuln.today
CVSS changed
Jun 25, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_counter: serialize reset with spinlock

Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values.

The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them.

A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.

AnalysisAI

Counter value underrun in the Linux kernel's netfilter nft_counter subsystem allows a local unprivileged user to corrupt nftables packet and byte counter data through a race condition in concurrent dump-and-reset operations. Two parallel resets can each read the same counter totals and both subtract them, causing the counters to underrun - potentially wrapping unsigned values to astronomically large figures and producing incorrect firewall accounting. No public exploit exists and EPSS is 0.02% (5th percentile), consistent with a low-priority correctness defect rather than a targeted security attack vector.

Technical ContextAI

Netfilter is the Linux kernel's core packet filtering and NAT framework, and nft_counter is a native nftables counter object used to accumulate per-rule packet and byte statistics. The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) race condition: the 'dump-and-reset' operation - which fetches the current running total across per-CPU counter shards and then zeroes them - was not serialized. Two threads executing this operation concurrently could both observe the same pre-reset total, then both issue the subtraction, leaving the counter in an underrun state. Because these are likely unsigned 64-bit integers, underflow wraps to a very large value. The fix introduces a global static spinlock around the fetch-then-reset critical section. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. CWE was not formally assigned in NVD, but this maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) and CWE-191 (Integer Underflow).

RemediationAI

The primary fix is to update to a patched Linux kernel version: 6.19.4 or 7.0 per EUVD data, with stable-branch patches accessible via the kernel stable git at https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e and https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f15a43526841b679445c32e2. Distribution vendors (RHEL, Debian, Ubuntu, SUSE) typically backport these stable commits into their own kernel packages; administrators should apply the latest kernel update from their distribution's security channels. As a compensating control, environments that do not use nftables counter objects can avoid exposure entirely by auditing nftables rulesets and removing unnecessary counter statements - this eliminates the vulnerable code path without kernel upgrade. Note that disabling all counters may reduce firewall observability. No reboot-free mitigations are available for live systems without a kernel patch.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-32363 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy