CVE-2026-45860

Estado: AnalizadaAlta (7.5)—

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: increase the connection clean up limit to 64

After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly.

In order to prevent this issue, only skip the GC if it was already triggered during the same jiffy and the increment is lower than the clean up limit. In addition, increase the clean up limit to 64 connections to avoid triggering GC too often and do more effective GCs.

Leer descripción completaMostrar menos

This has been tested using a HTTP server and several performance tools while having nft_connlimit/xt_connlimit or OVS limit configured.

Output of slowhttptest + OVS limit at 52000 connections:

slow HTTP test status on 340th second: initializing: 0 pending: 432 connected: 51998 error: 0 closed: 0 service available: YES

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.70%
Percentil entre todas las CVEs puntuadas: 51
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access45 %
Impacto principalT1499.004 Application or System Exploitationimpact75 %

Vulnerabilidad de DoS en netfilter por limpieza ineficiente de conexiones rastreadas; vector CVSS AV:N permite explotación remota. La pista sugiere T1499 (DoS).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-45860",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f106694733c66a48740c25bc4e212e9b2ea364ce",
              "lessThan": "a5c9e14e0e8923218ae881d5e78c990c07694966",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be69850b461e7b491d87a22e33ab76fdd04b725e",
              "lessThan": "13eede458fdf231f1bf96a398feea4ad1553f14c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "fa85432d58c8e74b39333edbf8d28df2985dfc79",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "0792ad077d776c2dcf20f0484e2461ded1b77a24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "3d0994ed0aa1fc0a2c5e620b765e8defdd021bff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "6e5fa7add3e76da068a478d905be64be8fa4e80a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "0af0812baf2d363176c9b76fc07e33f13aede8db",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "lessThan": "21d033e472735ecec677f1ae46d6740b5e47a4f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.248",
              "lessThan": "5.10.252",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.198",
              "lessThan": "5.15.202",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/net/netfilter/nf_conntrack_count.h",
            "net/netfilter/nf_conncount.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/net/netfilter/nf_conntrack_count.h",
            "net/netfilter/nf_conncount.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-27T14:16:58.187",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0792ad077d776c2dcf20f0484e2461ded1b77a24",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0af0812baf2d363176c9b76fc07e33f13aede8db",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/13eede458fdf231f1bf96a398feea4ad1553f14c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/21d033e472735ecec677f1ae46d6740b5e47a4f3",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3d0994ed0aa1fc0a2c5e620b765e8defdd021bff",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e5fa7add3e76da068a478d905be64be8fa4e80a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a5c9e14e0e8923218ae881d5e78c990c07694966",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa85432d58c8e74b39333edbf8d28df2985dfc79",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: increase the connection clean up limit to 64\n\nAfter the optimization to only perform one GC per jiffy, a new problem\nwas introduced. If more than 8 new connections are tracked per jiffy the\nlist won't be cleaned up fast enough possibly reaching the limit\nwrongly.\n\nIn order to prevent this issue, only skip the GC if it was already\ntriggered during the same jiffy and the increment is lower than the\nclean up limit. In addition, increase the clean up limit to 64\nconnections to avoid triggering GC too often and do more effective GCs.\n\nThis has been tested using a HTTP server and several\nperformance tools while having nft_connlimit/xt_connlimit or OVS limit\nconfigured.\n\nOutput of slowhttptest + OVS limit at 52000 connections:\n\n slow HTTP test status on 340th second:\n initializing:        0\n pending:             432\n connected:           51998\n error:               0\n closed:              0\n service available:   YES"
    }
  ],
  "lastModified": "2026-06-25T21:07:36.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF383F2-E238-49E9-870A-004DCE6EC4EE",
              "versionEndExcluding": "5.10.252",
              "versionStartIncluding": "5.10.248"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E8A14C6-5AE2-428C-8575-4BA8348BC6C7",
              "versionEndExcluding": "5.15.202",
              "versionStartIncluding": "5.15.198"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DD2C202-0D8D-4C7D-A980-CFCF610F7707",
              "versionEndExcluding": "6.1.165",
              "versionStartIncluding": "5.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2",
              "versionEndExcluding": "6.6.128",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
              "versionEndExcluding": "6.12.75",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF463CB7-1F58-4607-B847-77ED23E4B9B7",
              "versionEndExcluding": "6.18.14",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092",
              "versionEndExcluding": "6.19.4",
              "versionStartIncluding": "6.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}