GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-45859 (GCVE-0-2026-45859)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:15 – Updated: 2026-08-05 12:28
VLAI
Title
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capability flag and a gso packet with an unconfirmed nf_conn entry is received all packets are now dropped instead of queued, because the check happens after skb_gso_segment(). In that case, we did have exclusive ownership of the skb and its associated conntrack entry. The elevated use count is due to skb_clone happening via skb_gso_segment(). Move the check so that its peformed vs. the aggregated packet. Then, annotate the individual segments except the first one so we can do a 2nd check at reinject time. For the normal case, where userspace does in-order reinjects, this avoids packet drops: first reinjected segment continues traversal and confirms entry, remaining segments observe the confirmed entry. While at it, simplify nf_ct_drop_unconfirmed(): We only care about unconfirmed entries with a refcnt > 1, there is no need to special-case dying entries. This only happens with UDP. With TCP, the only unconfirmed packet will be the TCP SYN, those aren't aggregated by GRO. Next patch adds a udpgro test case to cover this scenario.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb , < 79b713ef4261a8ead96af4703f89d0b5f25532e2 (git)
Affected: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb , < 23901aa6b8a2f294c4b774436b4691f3ff863a8f (git)
Affected: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb , < b740e7ddd7ca0dbfeafca3f5e52717206cf28524 (git)
Affected: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb , < 207b3ebacb6113acaaec0d171d5307032c690004 (git)
Affected: 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3 (git)
Affected: 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86 (git)
Affected: 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0 (git)
Affected: 025b3326c5c409b372d0103ad30f174e55adbd1b (git)
Affected: 5.15.166 , < 5.16 (semver)
Affected: 6.1.107 , < 6.2 (semver)
Affected: 6.6.48 , < 6.7 (semver)
Affected: 6.10.7 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79b713ef4261a8ead96af4703f89d0b5f25532e2",
              "status": "affected",
              "version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
              "versionType": "git"
            },
            {
              "lessThan": "23901aa6b8a2f294c4b774436b4691f3ff863a8f",
              "status": "affected",
              "version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
              "versionType": "git"
            },
            {
              "lessThan": "b740e7ddd7ca0dbfeafca3f5e52717206cf28524",
              "status": "affected",
              "version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
              "versionType": "git"
            },
            {
              "lessThan": "207b3ebacb6113acaaec0d171d5307032c690004",
              "status": "affected",
              "version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6dcc8ba8a6074bb79040f502dc66ad23a58a1c86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "025b3326c5c409b372d0103ad30f174e55adbd1b",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_queue.h",
            "net/netfilter/nfnetlink_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.166",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the \u0027F_GSO\u0027 capability flag and a gso\npacket with an unconfirmed nf_conn entry is received all packets are\nnow dropped instead of queued, because the check happens after\nskb_gso_segment().  In that case, we did have exclusive ownership\nof the skb and its associated conntrack entry.  The elevated use\ncount is due to skb_clone happening via skb_gso_segment().\n\nMove the check so that its peformed vs. the aggregated packet.\n\nThen, annotate the individual segments except the first one so we\ncan do a 2nd check at reinject time.\n\nFor the normal case, where userspace does in-order reinjects, this avoids\npacket drops: first reinjected segment continues traversal and confirms\nentry, remaining segments observe the confirmed entry.\n\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\nunconfirmed entries with a refcnt \u003e 1, there is no need to special-case\ndying entries.\n\nThis only happens with UDP.  With TCP, the only unconfirmed packet will\nbe the TCP SYN, those aren\u0027t aggregated by GRO.\n\nNext patch adds a udpgro test case to cover this scenario."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable nfnetlink_queue path processes packets that hit an NFQUEUE netfilter verdict; GRO-aggregated UDP traffic received from the network reaches it, so the dropping condition is triggered by remote network packets.\nAC:L - Once an nfqueue without F_GSO exists, an attacker reliably triggers the drop by sending a UDP burst that GRO coalesces into a GSO skb for a new (unconfirmed) flow; no uncontrollable condition is required.\nPR:N - Triggering the condition requires only sending network traffic to the host; no authentication or privileges are needed by the remote sender.\nUI:N - The packet drop occurs automatically during kernel packet processing with no victim interaction.\nS:U - The impact is confined to the kernel\u0027s own network packet processing; no security boundary is crossed.\nC:N - The bug only causes packets to be dropped; no kernel memory is read or disclosed.\nI:N - No data is modified or written; dropped packets are simply not delivered, which is an availability rather than integrity effect.\nA:H - All GSO-aggregated UDP packets of new (unconfirmed) conntrack flows are dropped on a non-F_GSO nfqueue, denying establishment/processing of those new flows \u2014 a sustained, network-triggerable denial of that traffic class."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:30.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524"
        },
        {
          "url": "https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004"
        }
      ],
      "title": "netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45859",
    "datePublished": "2026-05-27T12:15:39.322Z",
    "dateReserved": "2026-05-13T15:03:33.079Z",
    "dateUpdated": "2026-08-05T12:28:30.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45859",
      "date": "2026-09-16",
      "epss": "0.00612",
      "percentile": "0.4767"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:52:26.000Z",
      "cve": "CVE-2026-45859",
      "id": "msrc_CVE-2026-45859",
      "initial_release_date": "2026-05-28T01:08:39.000Z",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-45859.json",
      "version": "8"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45859\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:16:58.060\",\"lastModified\":\"2026-06-25T21:07:39.220\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\\n\\nUlrich reports a regression with nfqueue:\\n\\nIf an application did not set the \u0027F_GSO\u0027 capability flag and a gso\\npacket with an unconfirmed nf_conn entry is received all packets are\\nnow dropped instead of queued, because the check happens after\\nskb_gso_segment().  In that case, we did have exclusive ownership\\nof the skb and its associated conntrack entry.  The elevated use\\ncount is due to skb_clone happening via skb_gso_segment().\\n\\nMove the check so that its peformed vs. the aggregated packet.\\n\\nThen, annotate the individual segments except the first one so we\\ncan do a 2nd check at reinject time.\\n\\nFor the normal case, where userspace does in-order reinjects, this avoids\\npacket drops: first reinjected segment continues traversal and confirms\\nentry, remaining segments observe the confirmed entry.\\n\\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\\nunconfirmed entries with a refcnt \u003e 1, there is no need to special-case\\ndying entries.\\n\\nThis only happens with UDP.  With TCP, the only unconfirmed packet will\\nbe the TCP SYN, those aren\u0027t aggregated by GRO.\\n\\nNext patch adds a udpgro test case to cover this scenario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/netfilter/nf_queue.h\",\"net/netfilter/nfnetlink_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb\",\"lessThan\":\"79b713ef4261a8ead96af4703f89d0b5f25532e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb\",\"lessThan\":\"23901aa6b8a2f294c4b774436b4691f3ff863a8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb\",\"lessThan\":\"b740e7ddd7ca0dbfeafca3f5e52717206cf28524\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb\",\"lessThan\":\"207b3ebacb6113acaaec0d171d5307032c690004\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6dcc8ba8a6074bb79040f502dc66ad23a58a1c86\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"025b3326c5c409b372d0103ad30f174e55adbd1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.166\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.107\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.48\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.10.7\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/netfilter/nf_queue.h\",\"net/netfilter/nfnetlink_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.166\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"1A731D98-0099-445F-8630-635D92F0D901\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.107\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"8A1E4A4D-E736-4034-B734-953CD5D22F1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.48\",\"versionEndExcluding\":\"6.7\",\"matchCriteriaId\":\"72C40D03-D807-412F-8A03-2556A2D70DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.7\",\"versionEndExcluding\":\"6.11\",\"matchCriteriaId\":\"48B1FCEA-70A6-45BD-A39B-9184638703FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.1\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"1C462C6C-BC40-4018-A8C4-C32BDE9791C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"BF463CB7-1F58-4607-B847-77ED23E4B9B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4770BA57-3F3F-493B-8608-EC3B25254949\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE5298B3-04B4-4F3E-B186-01A58B5C75A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:50:45+00:00",
      "cve": "CVE-2026-45859",
      "id": "CVE-2026-45859",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45859.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:14:46Z",
      "cve": "CVE-2026-45859",
      "id": "CVE-2026-45859",
      "initial_release_date": "2026-05-28T03:57:21Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "370",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45859",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45859.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.