CVE-2026-45897 (GCVE-0-2026-45897)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:17 – Updated: 2026-09-14 11:58
VLAI
Title
netfilter: nft_counter: serialize reset with spinlock
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_counter: serialize reset with spinlock Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values. The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them. A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb1adb05ea87b6149e65a31e511756c4f470d0cd , < e13194e60217db02c2e7202375d9e5951267d87b (git)
Affected: f123293db16dcd0cd81b246ae60e6362f0025d0a , < de6601f1374fab124cd9276df6671f64d940ceb4 (git)
Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 48cf7918d10c66cb6b05226fa3fa5daf0c891089 (git)
Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1 (git)
Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 0cdc6d5a26f2d1f7f15a43526841b679445c32e2 (git)
Affected: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 , < 779c60a5190c42689534172f4b49e927c9959e4e (git)
Affected: 6.1.107 , < 6.1.188 (semver)
Affected: 6.6.48 , < 6.6.157 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_counter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e13194e60217db02c2e7202375d9e5951267d87b",
              "status": "affected",
              "version": "fb1adb05ea87b6149e65a31e511756c4f470d0cd",
              "versionType": "git"
            },
            {
              "lessThan": "de6601f1374fab124cd9276df6671f64d940ceb4",
              "status": "affected",
              "version": "f123293db16dcd0cd81b246ae60e6362f0025d0a",
              "versionType": "git"
            },
            {
              "lessThan": "48cf7918d10c66cb6b05226fa3fa5daf0c891089",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "0cdc6d5a26f2d1f7f15a43526841b679445c32e2",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "779c60a5190c42689534172f4b49e927c9959e4e",
              "status": "affected",
              "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_counter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_counter: serialize reset with spinlock\n\nAdd a global static spinlock to serialize counter fetch+reset\noperations, preventing concurrent dump-and-reset from underrunning\nvalues.\n\nThe lock is taken before fetching the total so that two parallel\nresets cannot both read the same counter values and then both\nsubtract them.\n\nA global lock is used for simplicity since resets are infrequent.\nIf this becomes a bottleneck, it can be replaced with a per-net\nlock later."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:21.488Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e13194e60217db02c2e7202375d9e5951267d87b"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6601f1374fab124cd9276df6671f64d940ceb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/48cf7918d10c66cb6b05226fa3fa5daf0c891089"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f15a43526841b679445c32e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"
        }
      ],
      "title": "netfilter: nft_counter: serialize reset with spinlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45897",
    "datePublished": "2026-05-27T12:17:07.038Z",
    "dateReserved": "2026-05-13T15:03:33.083Z",
    "dateUpdated": "2026-09-14T11:58:21.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45897",
      "date": "2026-10-02",
      "epss": "0.0016",
      "percentile": "0.04605"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:32:49.000Z",
      "cve": "CVE-2026-45897",
      "id": "msrc_CVE-2026-45897",
      "initial_release_date": "2026-05-28T01:06:49.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nft_counter: serialize reset with spinlock",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-45897.json",
      "version": "10"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_counter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e13194e60217db02c2e7202375d9e5951267d87b",
                    "status": "affected",
                    "version": "fb1adb05ea87b6149e65a31e511756c4f470d0cd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de6601f1374fab124cd9276df6671f64d940ceb4",
                    "status": "affected",
                    "version": "f123293db16dcd0cd81b246ae60e6362f0025d0a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "48cf7918d10c66cb6b05226fa3fa5daf0c891089",
                    "status": "affected",
                    "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1",
                    "status": "affected",
                    "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0cdc6d5a26f2d1f7f15a43526841b679445c32e2",
                    "status": "affected",
                    "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "779c60a5190c42689534172f4b49e927c9959e4e",
                    "status": "affected",
                    "version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.188",
                    "status": "affected",
                    "version": "6.1.107",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.48",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_counter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A1E4A4D-E736-4034-B734-953CD5D22F1D",
                    "versionEndExcluding": "6.2",
                    "versionStartIncluding": "6.1.107",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3E44F97-A592-4211-A207-407DFC22549C",
                    "versionEndExcluding": "6.19.4",
                    "versionStartIncluding": "6.6.48",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_counter: serialize reset with spinlock\n\nAdd a global static spinlock to serialize counter fetch+reset\noperations, preventing concurrent dump-and-reset from underrunning\nvalues.\n\nThe lock is taken before fetching the total so that two parallel\nresets cannot both read the same counter values and then both\nsubtract them.\n\nA global lock is used for simplicity since resets are infrequent.\nIf this becomes a bottleneck, it can be replaced with a per-net\nlock later."
          }
        ],
        "id": "CVE-2026-45897",
        "lastModified": "2026-09-14T12:17:41.570",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-05-27T14:17:03.977",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0cdc6d5a26f2d1f7f15a43526841b679445c32e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/48cf7918d10c66cb6b05226fa3fa5daf0c891089"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/779c60a5190c42689534172f4b49e927c9959e4e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd968dcdec6aee79a2d399e4f6e0eca63c3b45e1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de6601f1374fab124cd9276df6671f64d940ceb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e13194e60217db02c2e7202375d9e5951267d87b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-27T16:19:42+00:00",
      "cve": "CVE-2026-45897",
      "id": "CVE-2026-45897",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_counter: serialize reset with spinlock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45897.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:55:05Z",
      "cve": "CVE-2026-45897",
      "id": "CVE-2026-45897",
      "initial_release_date": "2026-05-28T03:56:38Z",
      "product_status:known_affected": "411",
      "product_status:known_not_affected": "338",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45897",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45897.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.