CVE-2026-45859

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Ulrich reports a regression with nfqueue:

If an application did not set the 'F_GSO' capability flag and a gso

packet with an unconfirmed nf_conn entry is received all packets are

now dropped instead of queued, because the check happens after

skb_gso_segment(). In that case, we did have exclusive ownership

of the skb and its associated conntrack entry. The elevated use

count is due to skb_clone happening via skb_gso_segment().

Move the check so that its peformed vs. the aggregated packet.

Then, annotate the individual segments except the first one so we

can do a 2nd check at reinject time.

For the normal case, where userspace does in-order reinjects, this avoids

packet drops: first reinjected segment continues traversal and confirms

entry, remaining segments observe the confirmed entry.

While at it, simplify nf_ct_drop_unconfirmed(): We

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References