CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel5.10.248 and later · before 5.10.252
• linux linux kernel5.15.198 and later · before 5.15.202
• linux linux kernel5.19 and later · before 6.1.165
• linux linux kernel6.2 and later · before 6.6.128
• linux linux kernel6.7 and later · before 6.12.75
• linux linux kernel6.13 and later · before 6.18.14
• linux linux kernel6.19 and later · before 6.19.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.19affected
  • f106694733c66a48740c25bc4e212e9b2ea364ce and later · before a5c9e14e0e8923218ae881d5e78c990c07694966affected · git
  • be69850b461e7b491d87a22e33ab76fdd04b725e and later · before 13eede458fdf231f1bf96a398feea4ad1553f14caffected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before fa85432d58c8e74b39333edbf8d28df2985dfc79affected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before 0792ad077d776c2dcf20f0484e2461ded1b77a24affected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before 3d0994ed0aa1fc0a2c5e620b765e8defdd021bffaffected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before 6e5fa7add3e76da068a478d905be64be8fa4e80aaffected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before 0af0812baf2d363176c9b76fc07e33f13aede8dbaffected · git
  • d265929930e2ffafc744c0ae05fb70acd53be1ee and later · before 21d033e472735ecec677f1ae46d6740b5e47a4f3affected · git
  • 5.10.248 and later · before 5.10.252affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-45856May 27, 2026 · RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
  28Monitor
• ← EarlierCVE-2026-45859May 27, 2026 · netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
  30Monitor
• Later →CVE-2026-45861May 27, 2026 · gfs2: Fix slab-use-after-free in qd_put
  31Monitor

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.