CVE-2026-45897: Linux Kernel Race Condition Vulnerability

CVE-2026-45897 Overview

CVE-2026-45897 is a race condition vulnerability in the Linux kernel's netfilter nft_counter module. The flaw allows concurrent dump-and-reset operations to underrun counter values because fetch and reset are not atomic. Two parallel resets can read the same counter values and then both subtract them, producing inconsistent state. The Linux kernel maintainers resolved the issue by introducing a global static spinlock that serializes counter fetch and reset operations within nft_counter.

Critical Impact
Concurrent nft_counter reset operations can underrun counter values, causing inaccurate accounting in netfilter rules used for traffic statistics, accounting policies, and rate-based decisions.

Affected Products

Linux kernel netfilter subsystem (nft_counter module)
Linux distributions shipping affected kernel versions prior to the fix commits
Systems using nftables counters with concurrent dump-and-reset workflows

Discovery Timeline

2026-05-27 - CVE-2026-45897 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45897

Vulnerability Analysis

The vulnerability resides in the Linux kernel netfilter nft_counter module. The module maintains per-rule packet and byte counters that user space can query and atomically reset through nftables dump-and-reset operations. The fetch-then-reset sequence was not serialized, creating a race condition window between reading the current counter value and subtracting it from the running total.

When two threads invoke a dump-and-reset operation concurrently, both can observe the same pre-reset counter snapshot. Each thread then subtracts that snapshot from the live counter, causing the second subtraction to underrun the actual counter value. The result is corrupted accounting that can produce negative or wrapped counter readings.

Root Cause

The root cause is missing synchronization around the combined fetch-and-reset operation in nft_counter. Counter updates use per-CPU atomic operations, but the higher-level reset sequence reads totals and then performs a subtraction without holding a lock. This creates a classic time-of-check to time-of-use window where parallel resets interleave.

Attack Vector

Triggering the race requires local privileges sufficient to invoke nftables dump-and-reset operations, typically CAP_NET_ADMIN within the relevant network namespace. The vulnerability does not enable remote code execution or privilege escalation. Impact is limited to integrity of counter values used by netfilter rules. The upstream fix, applied in commits 0cdc6d5a26f2 and 779c60a5190c, adds a global static spinlock taken before fetching the total so two parallel resets cannot both read the same counter values and then both subtract them. A global lock was chosen for simplicity because resets are infrequent.

The vulnerability is described in prose only; refer to the upstream patches for the exact code changes. See Kernel Git Commit 0cdc6d5 and Kernel Git Commit 779c60a for the authoritative fix.

Detection Methods for CVE-2026-45897

Indicators of Compromise

Negative, wrapped, or implausibly small values returned by nft list ruleset for counters that were known to be incrementing
Discrepancies between nft_counter byte and packet totals and corresponding interface or conntrack statistics
Logs showing multiple concurrent nftables reset operations from monitoring agents or scripts

Detection Strategies

Audit kernel package versions across Linux hosts and compare against distribution advisories referencing commits 0cdc6d5a26f2 and 779c60a5190c
Review automation that periodically performs nft reset counters to identify configurations that issue resets in parallel
Validate counter integrity by cross-checking nftables counters against independent traffic accounting sources

Monitoring Recommendations

Track uname -r output and kernel build metadata in your asset inventory to identify hosts running unpatched kernels
Alert on counter values that decrease unexpectedly between consecutive polling intervals
Monitor invocations of nft and netlink NFT_MSG_GETOBJ_RESET messages to detect concurrent reset patterns

How to Mitigate CVE-2026-45897

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in commits 0cdc6d5a26f2 and 779c60a5190c through your distribution's stable kernel updates
Inventory hosts that rely on nft_counter for accounting or rate-limiting decisions and prioritize them for patching
Restrict CAP_NET_ADMIN to trusted administrative accounts and processes within each network namespace

Patch Information

The fix was committed upstream and is available through the Linux kernel stable tree. Reference the patches at Kernel Git Commit 0cdc6d5 and Kernel Git Commit 779c60a. Consume the fix via your Linux distribution's kernel update channel and reboot affected systems.

Workarounds

Serialize nftables dump-and-reset operations in user-space tooling so only one reset runs at a time per host
Reduce reliance on nft_counter reset semantics where possible by switching to delta calculations from monotonic counters
Limit which users and services can invoke nft reset commands until patched kernels are deployed

bash

# Configuration example: verify kernel version and serialize nftables reset operations
uname -r

# Use flock to ensure only one nft reset runs at a time
flock /var/lock/nft-counter-reset.lock nft reset counters