PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45860 Linux CVE debrief

A vulnerability in the Linux kernel's netfilter nf_conncount subsystem could cause premature connection limit enforcement under high connection rates. The issue stems from an optimization that limited garbage collection (GC) to once per jiffy. When more than 8 new connections are tracked per jiffy, the cleanup cannot keep pace, potentially causing legitimate connections to be rejected when limits are reached incorrectly. The fix increases the cleanup limit from 8 to 64 connections and adds logic to skip GC only when it was already triggered in the same jiffy AND the increment is below the cleanup threshold. This ensures more effective garbage collection while preventing excessive GC overhead. The vulnerability affects systems using nft_connlimit, xt_connlimit, or OVS connection limiting features. Testing with slowhttptest demonstrated stable operation at 52,000 connections with OVS limit configured.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running Linux-based network infrastructure with connection limiting features enabled, particularly those using nftables connlimit rules, iptables xt_connlimit, or Open vSwitch connection rate limiting. Cloud providers and hosting platforms with multi-tenant networking may experience service degradation if connection limits are incorrectly enforced.

Technical summary

The nf_conncount mechanism in Linux netfilter tracks per-address connection counts for enforcing connection limits. A previous optimization restricted garbage collection to once per jiffy (typically 1-10ms depending on HZ configuration) to reduce overhead. However, this created a race condition: if new connections arrive faster than 8 per jiffy, stale entries accumulate and the connection list fills, triggering false limit violations. The fix implements conditional GC skipping—only bypassing cleanup if GC already ran this jiffy AND the current increment is below the new 64-connection threshold. This balances cleanup efficiency with correctness under high-throughput scenarios.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and apply appropriate stable kernel update containing the nf_conncount fix
  • Monitor connection tracking tables for unexpected limit enforcement under high connection rates
  • If running nftables connlimit or OVS connection limits, prioritize patching
  • Consider connection rate limiting at network edge as temporary mitigation if patching is delayed
  • Validate connection limit behavior under load after applying updates

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel netfilter nf_conncount subsystem. Multiple stable kernel branch commits are referenced, suggesting backports to various kernel versions. The fix was validated using HTTP server performance testing with slowhttptest and OVS limit configurations at 52,000 connections.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45860 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45860

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45860 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45860

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0792ad077d776c2dcf20f0484e2461ded1b77a24

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0af0812baf2d363176c9b76fc07e33f13aede8db

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/13eede458fdf231f1bf96a398feea4ad1553f14c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/21d033e472735ecec677f1ae46d6740b5e47a4f3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d0994ed0aa1fc0a2c5e620b765e8defdd021bff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6e5fa7add3e76da068a478d905be64be8fa4e80a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a5c9e14e0e8923218ae881d5e78c990c07694966

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.