CVE-2026-45860

A flaw was found in the Linux kernel's netfilter connection counting (nf_conncount) feature. This vulnerability occurs when the system tracks more than eight new connections per jiffy, causing the connection list to not be cleaned up efficiently. A remote attacker could exploit this by rapidly establishing connections, leading the system to incorrectly believe it has reached its connection limit. This can result in a denial of service, preventing legitimate users from establishing new connections.

This vulnerability is rated as Moderate because exploitation requires specific packet-filtering rules to be actively configured and primarily causes transient denial of service under high connection rates without compromising system memory integrity or granting unauthorized privileges. The underlying issue only manifests on hosts configured with connection limiting modules in nftables, iptables, or Open vSwitch when handling rapid bursts of new sessions. Default enterprise kernel deployments without active connection limit filtering rules are not exposed to this behavior, and older releases such as Red Hat Enterprise Linux 8 and 9 do not contain the affected code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.