CVE-2026-45860High· 7.0▾ TwilightA flaw was found in the Linux kernel's netfilter connection counting (nf_conncount) feature. This vulnerability occurs when the system tracks more than eight new connections per jiffy, causing the connection list to not be cleaned up effic…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
Last analysed / modified upstream
0.7% → 0.7%
7.5 → 7
A flaw was found in the Linux kernel's netfilter connection counting (nf_conncount) feature. This vulnerability occurs when the system tracks more than eight new connections per jiffy, causing the connection list to not be cleaned up efficiently. A remote attacker could exploit this by rapidly establishing connections, leading the system to incorrectly believe it has reached its connection limit. This can result in a denial of service, preventing legitimate users from establishing new connections.
kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-10-26.
Fixed:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:76738
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80775High· 7.0kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
CVE-2026-72320High· 7.0kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
CVE-2026-74516High· 8.2In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is activ…
CVE-2026-72052High· 7.8kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
CVE-2026-68432High· 7.0kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
CVE-2026-64557High· 7.0kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)