CVE-2026-45859netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
- 7.5HighCVSS base score
- 0.71%Exploitation in 30 daysEPSS · top 46% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capability flag and a gso packet with an unconfirmed nf_conn entry is received all packets are now dropped instead of queued, because the check happens after skb_gso_segment(). In that case, we did have exclusive ownership of the skb and its associated conntrack entry. The elevated use count is due to skb_clone happening via skb_gso_segment(). Move the check so that its peformed vs. the aggregated packet. Then, annotate the individual segments except the first one so we can do a 2nd check at reinject time. For the normal case, where userspace does in-order reinjects, this avoids packet drops: first reinjected segment continues traversal and confirms entry, remaining segments observe the confirmed entry. While at it, simplify nf_ct_drop_unconfirmed(): We only care about unconfirmed entries with a refcnt > 1, there is no need to special-case dying entries. This only happens with UDP. With TCP, the only unconfirmed packet will be the TCP SYN, those aren't aggregated by GRO. Next patch adds a udpgro test case to cover this scenario.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.71% · top 46% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86 – < 4666688657e1054278b836b825fb88b2907e2da2
- affected 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0 – < aead84bdacd77e08357fd718e5dcaffaf387f3c3
- affected 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb – < 79b713ef4261a8ead96af4703f89d0b5f25532e2
- affected 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb – < 23901aa6b8a2f294c4b774436b4691f3ff863a8f
- affected 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb – < b740e7ddd7ca0dbfeafca3f5e52717206cf28524
- affected 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb – < 207b3ebacb6113acaaec0d171d5307032c690004
- affected 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3
- affected 025b3326c5c409b372d0103ad30f174e55adbd1b
- affected 6.1.107 – < 6.1.191
- affected 6.6.48 – < 6.6.160
- affected 5.15.166 – < 5.16
- affected 6.10.7 – < 6.11
- affected 6.11
- unaffected < 6.11
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References6
- https://git.kernel.org/stable/c/4666688657e1054278b836b825fb88b2907e2da2 (opens in a new tab)
- https://git.kernel.org/stable/c/aead84bdacd77e08357fd718e5dcaffaf387f3c3 (opens in a new tab)
- https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2 (opens in a new tab)
- https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f (opens in a new tab)
- https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524 (opens in a new tab)
- https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32325 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45859)Record last updated .