LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_counter: serialize reset with spinlock Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values. The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them. A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A race condition in Linux nftables counters can make reported values incorrect when two counter dump-and-reset operations run simultaneously. This may undermine monitoring or accounting that depends on accurate counters. The supplied sources do not establish broader compromise, code execution, or firewall-rule bypass.

Executive priority

Treat this as a timely integrity and observability fix, not an evidence-backed emergency. Prioritize affected systems where nftables counters influence security decisions or financially significant accounting. Severity remains unscored, and no active exploitation is documented in the supplied sources.

Technical view

The nft_counter reset path was not serialized. Concurrent fetch-and-reset operations could read the same aggregate value and both subtract it, causing counter underruns. Linux resolved this by taking a global static spinlock before fetching totals, ensuring reset operations execute sequentially.

Likely exposure

Exposure is limited to Linux systems using nftables counters where dump-and-reset operations can overlap. The supplied version data identifies affected Linux releases but does not provide sufficiently clear range semantics for reliable fleet decisions. Confirm applicability through the system vendor or distribution.

Exploitation context

The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Triggering requires concurrent counter dump-and-reset activity; the available evidence describes incorrect counter values, not system takeover.

Researcher notes

The fix uses a global lock because resets are expected to be infrequent; the source notes it could later become per-network-namespace if contention emerges. No CVSS score or CWE is supplied. Version metadata should be correlated with distribution advisories and commit backports before declaring a host vulnerable.

Mitigation direction

  • Apply a vendor-supported kernel containing the applicable stable fix commit.
  • Check Linux distribution advisories for backported fixes and precise affected-version guidance.
  • Avoid overlapping nftables counter dump-and-reset operations until systems are updated.
  • Prioritize systems where counter accuracy supports security monitoring, billing, or operational decisions.

Validation and detection

  • Inventory running kernel versions and systems using nftables counters.
  • Compare vendor changelogs against the stable fix commits listed in the CVE record.
  • Review automation for potentially overlapping counter dump-and-reset operations.
  • After updating, confirm the fixed kernel is running and counter-reset workflows remain accurate.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45897 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3cb03edb4de33fd04c4ea55f47397b96a8657c53, 3cb03edb4de33fd04c4ea55f47397b96a8657c53, 3cb03edb4de33fd04c4ea55f47397b96a8657c53, 3cb03edb4de33fd04c4ea55f47397b96a8657c53, fb1adb05ea87b6149e65a31e511756c4f470d0cd, f123293db16dcd0cd81b246ae60e6362f0025d0a, 6.1.107, 6.6.48unaffected
LinuxLinux6.7, 0, 6.12.101, 6.18.42, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.