CVE-2026-45860: Linux Kernel netfilter DoS Vulnerability

CVE-2026-45860 Overview

CVE-2026-45860 affects the Linux kernel's netfilter subsystem, specifically the nf_conncount module used for connection tracking and limiting. A previous optimization restricted garbage collection (GC) to one execution per jiffy, but this introduced a regression. When more than eight new connections are tracked per jiffy, the connection list fails to clean up quickly enough, causing the module to incorrectly report that the configured connection limit has been reached.

The issue impacts environments using nft_connlimit, xt_connlimit, or Open vSwitch (OVS) connection limiting under high-throughput workloads such as HTTP servers handling tens of thousands of concurrent connections.

Critical Impact
The flaw causes premature rejection of legitimate connections when connection-limit rules are enforced, resulting in denial of service for high-traffic services.

Affected Products

Linux kernel versions containing the nf_conncount GC optimization prior to the fix
Systems using nft_connlimit netfilter connection limiting
Systems using xt_connlimit iptables connection limiting or Open vSwitch (OVS) connection limits

Discovery Timeline

2026-05-27 - CVE-2026-45860 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45860

Vulnerability Analysis

The vulnerability resides in the nf_conncount netfilter module, which tracks the number of connections matching a given criterion. After an earlier optimization limited garbage collection to a single run per jiffy, the cleanup path could not keep pace with bursts of new connections. When more than eight connections were created within the same jiffy, stale entries accumulated and the kernel treated the configured limit as exceeded.

This is a logic flaw in resource accounting rather than a memory safety issue. The consequence is functional rather than corrupting: legitimate traffic is dropped because the kernel believes the connection limit has been hit.

Root Cause

The root cause is the interaction between the per-jiffy GC throttle and the rate of new connection insertions. The throttle was introduced to reduce GC overhead, but it did not account for high connection arrival rates. With only one GC opportunity per jiffy and a low increment threshold, expired entries remained in the list, inflating the apparent connection count.

Attack Vector

The condition is reachable by any workload that generates more than eight connection insertions per jiffy against a host that uses nft_connlimit, xt_connlimit, or OVS connection limiting. Slow-HTTP and high-concurrency benchmark tools such as slowhttptest reproduced the behavior at around 52,000 concurrent connections, with new connections moving into a pending state instead of being established.

The fix raises the cleanup limit to 64 connections and adjusts the skip logic so that GC is bypassed only when it has already run during the current jiffy and the increment is below the cleanup limit. This produces fewer but more effective GC runs.

The vulnerability is described in prose only; refer to the upstream commits such as Linux Kernel Commit 0792ad07 and Linux Kernel Commit 21d033e4 for the exact code changes.

Detection Methods for CVE-2026-45860

Indicators of Compromise

Connection-limit rules rejecting traffic well below the configured threshold under high load.
nft_connlimit or xt_connlimit counters reporting limit-reached states while active connection counts remain lower.
Application logs showing connection failures concentrated during burst traffic on hosts running affected kernels.

Detection Strategies

Compare the running kernel version against the patched commits listed in the NVD references.
Reproduce with a controlled load test using tools such as slowhttptest against a host with nft_connlimit configured and observe whether pending connections accumulate before the configured limit is reached.
Correlate netfilter drop counters with application-level connection failures during traffic spikes.

Monitoring Recommendations

Track netfilter and conntrack metrics including nf_conntrack_count, drop counters, and rule-hit counts on hosts using connection limiting.
Alert on sudden rises in connection rejection rates that do not correspond to actual traffic volume.
Monitor kernel package versions across the fleet to confirm that affected builds are upgraded.

How to Mitigate CVE-2026-45860

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all systems using nf_conncount, nft_connlimit, xt_connlimit, or OVS connection limits.
Update to a distribution kernel that includes the fix raising the cleanup limit to 64 connections.
Validate connection-limit behavior after patching using a representative load test.

Patch Information

The fix is distributed across multiple stable-tree commits, including Linux Kernel Commit 0af0812b, Linux Kernel Commit 13eede45, Linux Kernel Commit 3d0994ed, Linux Kernel Commit 6e5fa7ad, Linux Kernel Commit a5c9e14e, and Linux Kernel Commit fa85432d. The patches raise the cleanup limit to 64 and refine the GC skip condition.

Workarounds

Where patching is not immediately possible, raise the configured connlimit threshold to absorb premature rejections, accepting reduced enforcement accuracy.
Reduce burst connection rates with upstream rate limiting or load balancing in front of affected hosts.
Where feasible, disable nft_connlimit or xt_connlimit rules on hosts that experience the regression until the kernel is updated.

bash

# Verify the running kernel version and reload netfilter rules after patching
uname -r
nft list ruleset | grep -i connlimit