CVE-2026-45859: Linux Kernel Netfilter Queue DoS Flaw

CVE-2026-45859 Overview

CVE-2026-45859 is a Linux kernel regression in the netfilter subsystem, specifically within nfnetlink_queue. The flaw affects how the kernel handles Generic Segmentation Offload (GSO) packets carrying unconfirmed nf_conn conntrack entries. When an application does not set the F_GSO capability flag, all packets are dropped instead of being queued to userspace. The drop occurs because the shared-unconfirmed check runs after skb_gso_segment(), which inflates the skb reference count via skb_clone(). The defect manifests primarily with UDP traffic processed through GRO aggregation. TCP is largely unaffected because only the TCP SYN is unconfirmed and SYN packets are not aggregated by GRO.

Critical Impact
Applications using nfqueue without the F_GSO flag silently drop legitimate UDP traffic, breaking userspace packet inspection workflows that rely on queue-based filtering.

Affected Products

Linux kernel versions containing the nfnetlink_queue regression prior to the upstream fix
Distributions shipping affected stable kernel branches referenced by commits 207b3eb, 23901aa, 79b713e, and b740e7d
Userspace applications relying on nfqueue without NFQA_CFG_F_GSO capability negotiation

Discovery Timeline

2026-05-27 - CVE-2026-45859 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45859

Vulnerability Analysis

The nfnetlink_queue subsystem allows userspace programs to receive packets from the kernel for inspection through the NFQUEUE target. Applications negotiate capabilities such as F_GSO, which determines whether the kernel may forward GSO superpackets directly or must first segment them. When F_GSO is not negotiated, the kernel calls skb_gso_segment() to break the aggregate into individual segments before queueing.

The regression stems from ordering: the shared-unconfirmed check in nf_ct_drop_unconfirmed() ran after segmentation. Segmentation clones the original sk_buff, which raises the reference count on the associated unconfirmed conntrack entry above 1. The post-segmentation check then misinterprets this elevated refcount as shared ownership and drops every segment. Before segmentation, the kernel held exclusive ownership of both the skb and its conntrack entry, so the check would have passed.

Root Cause

The root cause is incorrect placement of a reference-count safety check relative to skb_gso_segment(). The fix moves the unconfirmed-entry check to run against the aggregated packet before segmentation occurs. Individual segments other than the first are annotated so a second check at reinject time can validate them once the first segment confirms the conntrack entry. The patch also simplifies nf_ct_drop_unconfirmed() by removing special-casing for dying entries, since only unconfirmed entries with refcnt > 1 are relevant.

Attack Vector

This vulnerability is a functional regression rather than a directly exploitable security flaw. The practical effect is a denial-of-service condition for UDP traffic flowing through nfqueue-based filtering applications on affected kernels. The condition is triggered by normal network behavior when GRO aggregates UDP datagrams and the receiving nfqueue consumer has not advertised GSO support. No attacker action is required beyond sending UDP traffic that triggers GRO aggregation on the receiving host.

The vulnerability mechanism is described in the upstream commit messages. See the Linux Kernel Commit 207b3eb and Linux Kernel Commit b740e7d for the canonical fix descriptions.

Detection Methods for CVE-2026-45859

Indicators of Compromise

Unexpected UDP packet loss on hosts running nfqueue-based packet inspection tools
Conntrack statistics showing elevated drop counters in /proc/net/stat/nf_conntrack correlated with GRO-enabled interfaces
Userspace nfqueue consumers reporting empty queues despite active UDP traffic matching the configured rule

Detection Strategies

Compare running kernel version against the fixed commits 207b3eb, 23901aa, 79b713e, and b740e7d across affected stable branches
Audit nfqueue consumer code and configuration for use of the NFQA_CFG_F_GSO capability flag
Capture traffic at the kernel boundary using tcpdump and compare against what reaches the userspace queue handler to identify drops

Monitoring Recommendations

Track kernel log messages from the netfilter subsystem for unconfirmed conntrack drop events
Monitor nfnetlink_queue statistics exposed through /proc/net/netfilter/nfnetlink_queue for queue depth and drop counters
Alert on sustained divergence between expected and observed UDP throughput on hosts using NFQUEUE rules

How to Mitigate CVE-2026-45859

Immediate Actions Required

Apply the stable kernel updates that include the four upstream commits resolving the nfnetlink_queue ordering issue
Inventory all hosts running nfqueue-based applications such as IDS sensors, transparent proxies, and custom filtering daemons
Update affected userspace consumers to negotiate the NFQA_CFG_F_GSO capability where supported

Patch Information

The fix is delivered through four Linux stable tree commits: Linux Kernel Commit 207b3eb, Linux Kernel Commit 23901aa, Linux Kernel Commit 79b713e, and Linux Kernel Commit b740e7d. The patches relocate the shared-unconfirmed check before skb_gso_segment() and add per-segment annotations enabling a second validation pass at reinject time.

Workarounds

Disable Generic Receive Offload on affected interfaces using ethtool -K <iface> gro off to prevent UDP aggregation from triggering the drop path
Modify nfqueue consumer applications to set the NFQA_CFG_F_GSO flag during configuration, allowing the kernel to skip segmentation
Where feasible, replace NFQUEUE rules targeting UDP traffic with eBPF-based filtering until patched kernels are deployed

bash

# Configuration example: disable GRO to avoid triggering the regression
sudo ethtool -K eth0 gro off

# Verify GRO state
ethtool -k eth0 | grep generic-receive-offload