CVE-2026-45859

A flaw was found in the Linux kernel's netfilter (nfnetlink_queue) component. This vulnerability occurs when an application does not set the F_GSO capability flag and a Generic Segmentation Offload (GSO) packet with an unconfirmed netfilter connection (nf_conn) entry is received. Due to an incorrect order of checks, these packets are dropped instead of being queued. This can lead to a denial of service for affected UDP traffic.

This flaw is rated with Moderate severity because it only results in packet loss for specific UDP streams under non-default networking configurations rather than permitting privilege escalation or an arbitrary system crash. Exploitation requires the system to actively route traffic through netfilter user-space queues (NFQUEUE) handled by an application that does not negotiate GSO offload capabilities. Systems not forwarding traffic through custom NFQUEUE inspection daemons remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.