{"id":"CVE-2026-45859","title":"netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the 'F_GSO' capabi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 79b713ef4261a8ead96af4703f89d0b5f25532e2","Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 23901aa6b8a2f294c4b774436b4691f3ff863a8f","Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < b740e7ddd7ca0dbfeafca3f5e52717206cf28524","Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 207b3ebacb6113acaaec0d171d5307032c690004","Linux 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3","Linux 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86","Linux 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0","Linux 025b3326c5c409b372d0103ad30f174e55adbd1b","Linux >= 5.15.166 < 5.16","Linux >= 6.1.107 < 6.2","Linux >= 6.6.48 < 6.7","Linux >= 6.10.7 < 6.11","Linux 6.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:18:05.838159Z"},"published":"2026-05-27","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:45.559Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45859","references":[{"url":"https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2"},{"url":"https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f"},{"url":"https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524"},{"url":"https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004"}],"tags":["cve.org"],"epss":0.0063,"epssPercentile":0.49105,"ingestedAt":"2026-10-16T17:24:46.699Z","slug":"CVE-2026-45859","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the 'F_GSO' capability flag and a gso\npacket with an unconfirmed nf_conn entry is received all packets are\nnow dropped instead of queued, because the check happens after\nskb_gso_segment().  In that case, we did have exclusive ownership\nof the skb and its associated conntrack entry.  The elevated use\ncount is due to skb_clone happening via skb_gso_segment().\n\nMove the check so that its peformed vs. the aggregated packet.\n\nThen, annotate the individual segments except the first one so we\ncan do a 2nd check at reinject time.\n\nFor the normal case, where userspace does in-order reinjects, this avoids\npacket drops: first reinjected segment continues traversal and confirms\nentry, remaining segments observe the confirmed entry.\n\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\nunconfirmed entries with a refcnt > 1, there is no need to special-case\ndying entries.\n\nThis only happens with UDP.  With TCP, the only unconfirmed packet will\nbe the TCP SYN, those aren't aggregated by GRO.\n\nNext patch adds a udpgro test case to cover this scenario.\n\n## Affected\n\n- `Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 79b713ef4261a8ead96af4703f89d0b5f25532e2`\n- `Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 23901aa6b8a2f294c4b774436b4691f3ff863a8f`\n- `Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < b740e7ddd7ca0dbfeafca3f5e52717206cf28524`\n- `Linux >= 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb < 207b3ebacb6113acaaec0d171d5307032c690004`\n- `Linux 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3`\n- `Linux 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86`\n- `Linux 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0`\n- `Linux 025b3326c5c409b372d0103ad30f174e55adbd1b`\n- `Linux >= 5.15.166 < 5.16`\n- `Linux >= 6.1.107 < 6.2`\n- `Linux >= 6.6.48 < 6.7`\n- `Linux >= 6.10.7 < 6.11`\n- `Linux 6.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}