[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-45859":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":29,"references":31,"score":37,"epss_score":38,"epss_percentile":39,"is_kev":40,"cisa_kev_date_added":41,"cisa_kev_due_date":41,"cisa_ssvc":42,"attack_mappings":52,"exploits":68},2048,"CVE-2026-45859","EUVD-2026-32325","In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the 'F_GSO' capability flag and a gso\npacket with an unconfirmed nf_conn entry is received all packets are\nnow dropped instead of queued, because the check happens after\nskb_gso_segment().  In that case, we did have exclusive ownership\nof the skb and its associated conntrack entry.  The elevated use\ncount is due to skb_clone happening via skb_gso_segment().\n\nMove the check so that its peformed vs. the aggregated packet.\n\nThen, annotate the individual segments except the first one so we\ncan do a 2nd check at reinject time.\n\nFor the normal case, where userspace does in-order reinjects, this avoids\npacket drops: first reinjected segment continues traversal and confirms\nentry, remaining segments observe the confirmed entry.\n\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\nunconfirmed entries with a refcnt > 1, there is no need to special-case\ndying entries.\n\nThis only happens with UDP.  With TCP, the only unconfirmed packet will\nbe the TCP SYN, those aren't aggregated by GRO.\n\nNext patch adds a udpgro test case to cover this scenario.","2026-05-27T14:16:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":15,"privilegesRequired":17,"confidentialityImpact":17},"UNCHANGED","3.1",7.5,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H","NONE","LOW",true,[21],"CWE-400",[23,24,25,26,27,28],"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",[30],"Linux Linux Kernel",[32,33,34,35,36],"https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F207b3ebacb6113acaaec0d171d5307032c690004","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F23901aa6b8a2f294c4b774436b4691f3ff863a8f","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002F79b713ef4261a8ead96af4703f89d0b5f25532e2","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Fb740e7ddd7ca0dbfeafca3f5e52717206cf28524","https:\u002F\u002Fgit.kernel.org\u002Fstable\u002Fc\u002Faead84bdacd77e08357fd718e5dcaffaf387f3c3",0.57,0.00655,0.51074,false,null,{"timestamp":43,"automatable":44,"tech_impact":45,"exploitation":46,"cisa_decision":47,"cisa_remediation_timeline":51},"2026-10-16T15:18:05.838159Z","yes","partial","none",{"vector":48,"decision":49,"priority":50},"CISAv1\u002FE:N\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T17:30:59.077618\u002F","attend","medium","14D",[53,59],{"name":54,"source":55,"tactics":56,"technique_id":58},"Exploit Public-Facing Application","attack_vector",[57],"initial-access","T1190",{"name":60,"source":61,"cwe_ids":62,"tactics":63,"capec_ids":65,"technique_id":67},"Endpoint Denial of Service","capec",[21],[64],"impact",[66],"CAPEC-227","T1499",[]]