CVE-2026-45897 netfilter: nft_counter: serialize reset with spinlock
A race condition in the Linux kernel netfilter counter reset allows concurrent operations to corrupt counter values, requiring a patch to serialize access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45897?
CVE-2026-45897 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_counter: serialize reset with spinlock
Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values.
The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them.
A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.
Which versions are affected by CVE-2026-45897?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45897?
Apply the vendor's patch.
Is CVE-2026-45897 being exploited?
There is no known exploitation of CVE-2026-45897 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88775, BELL-CVE-2026-45897, DEBIAN-CVE-2026-45897, GHSA-4c46-9f7j-r9vq, ROOT-OS-DEBIAN-12-CVE-2026-45897, ROOT-OS-DEBIAN-13-CVE-2026-45897 and 2 more.