On May 27, 2026, the Linux kernel project disclosed CVE-2026-45897, a race condition in the nftables firewall subsystem that could corrupt counter values when multiple processes reset them simultaneously. The fix—a single global spinlock—is deceptively simple, but the bug exposes a growing problem: even mundane firewall statistics can become security liabilities when automation trusts them blindly.

The Fix: A Spinlock and a Promise

The heart of the patch is a new global static spinlock in net/netfilter/nft_counter.c. It serializes the dump-and-reset operation, where the kernel reads a packet counter and then zeroes it. Without the lock, two parallel resets could read the same count before either subtracts, causing a double deduction and leaving the counter permanently underflowed. The result? Firewall rules might report impossible negative packet numbers or wildly incorrect byte totals.

The kernel commit messages (779c60a5190c and 0cdc6d5a26f2 in stable trees) make clear that the lock is intentionally global and simple. Since resets are infrequent—typically triggered by administrative commands or monitoring tools—the performance cost is negligible. The developers left the door open to per-network-namespace locks if needed, but for now, correctness trumps optimization.

Affected kernels span versions from 6.1.107 to before 6.2, and from 6.6.48 to before 6.19.4. The fix landed in 6.19.4 and later, with 7.0 and above unaffected. The NVD assigned a CVSS 3.1 base score of 5.5 (Medium), reflecting the local attack vector and limited availability impact—no remote code, no privilege escalation, just corrupted data.

How a Counter Race Corrupts Your Data

To understand the bug, picture a firewall rule that counts packets. A monitoring daemon asks for the current count and then resets it to measure the last interval’s traffic. If two such requests arrive at the exact same moment, both see the same initial value. Each subtracts that same number from the underlying counter, effectively removing it twice. The counter goes negative or wraps around, depending on implementation.

Under the hood, the nft_counter code maintains per-CPU counters to avoid contention on the hot path (where every packet increments a counter). When a dump-and-reset occurs, it aggregates the per-CPU values into a total, returns that to user space, and then subtracts the total from each per-CPU bucket. If two resets race, they both read the same aggregate total, subtract it twice, and leave the per-CPU counters with an artificial deficit. Future aggregations then report impossibly low counts.

This isn’t a hypothetical corner case. In busy environments with multiple observability tools, automated scripts, or container orchestration plugins that periodically reset nftables counters, the race is plausible. The attack surface requires local access and the ability to invoke netfilter operations, typically through nft commands. That limits remote exploitation, but in shared systems or cloud platforms where untrusted containers might be granted limited netfilter capabilities, the risk scales.

Who Is Affected? WSL, Containers, and Windows Admins

If you’re a Windows user, you might wonder why a Linux kernel bug matters. Here’s the connection: millions of developers and IT pros use Windows Subsystem for Linux (WSL 2), which runs a real Linux kernel provided by Microsoft. If your WSL environment uses nftables for testing firewall rules, running containerized applications, or mimicking production setups, you’re running this kernel code. A kernel update inside your WSL instance is your responsibility—Windows Update doesn’t always push the latest Linux kernel patches immediately.

Docker on Windows often runs Linux containers either through WSL 2 or a Hyper-V isolated VM, both of which rely on a full Linux kernel. Similarly, Kubernetes nodes running on Linux VMs managed from Windows tools can be affected. The vulnerability percolates into any environment where nftables serves as the firewall backend, which is the default on modern distributions like Ubuntu 22.04+, Debian 12+, RHEL 9+, and their derivatives.

Network appliances, cloud virtual firewalls, and even IoT gateways that build on these distributions are also in scope. The common thread is that anyone who consumes nftables counters—whether for billing, anomaly detection, or simply dashboarding—should verify their kernel version.

Why This CVE Matters Even If It’s Not a Showstopper

At first glance, CVE-2026-45897 seems trivial. No remote shell, no memory corruption. But its danger lies in eroding trust in security telemetry. Firewall logs and counters are the first line of forensic investigation. If an attacker knows they can induce underflow, they might craft a distraction or mask malicious traffic. The fix is a reminder that observability is no longer passive: it’s mutable state that must be protected like any other security-critical data.

Consider a SIEM that triggers an alert when dropped packet counts exceed a threshold. An intentionally triggered underflow could reset that counter, silencing the alarm. Similarly, network capacity planners who rely on nftables byte counters could make expensive provisioning mistakes. The impact isn’t about breaking into a system; it’s about breaking one’s confidence in the system’s self-awareness.

The NVD’s initial lack of a CVSS score (later enriched to 5.5) might have caused some triage desks to overlook it, but the Linux kernel’s CVE process is increasingly inclusive—assigning identifiers to flaws that once would have been silently patched. That’s a feature, not a bug: it forces organizations to reason explicitly about risks that lurk beneath the surface.

How We Got Here: nftables’ Rise and the Trust Problem

nftables replaced iptables as the default Linux firewall framework in many distributions around 2019–2020. It brought a more programmable ruleset, with counters as a built-in expression rather than a separate module. The ability to dump and reset counters atomically was a design choice for efficiency—instead of two system calls, one could do both. But that atomicity introduced a new race condition.

As Linux networking grew more automated, with tools like Calico, Cilium, and various CNI plugins manipulating netfilter rules programmatically, these counters became part of control loops. A counter no longer just told an admin what happened; it fed automated responses. That made accuracy paramount. The dump-and-reset pattern, while elegant, became a critical section waiting to be exploited.

The kernel community fixed similar races in other subsystems over the years, but nft_counter slipped through. It was a classic “works in practice” bug until concurrency stress testing or observability tooling revealed the issue. The fix’s simplicity—adding a spinlock—speaks to how often the reset path was overlooked: it wasn’t a performance hot spot, so nobody noticed the missing synchronization.

What to Do Now: Your Patch Checklist

  1. Check your kernel version. Run uname -r on every Linux system (including WSL). Compare against the affected ranges: 6.1.107–6.2, 6.6.48–6.19.3. If you’re on a version older than 6.19.4 or 7.0, you’re likely vulnerable unless your distribution has backported the fix.

  2. Update your kernel. Use your distro’s package manager (apt upgrade, yum update, etc.) or wait for your vendor’s advisories. For WSL, you can update the Linux kernel via wsl --update or manually from Microsoft’s WSL kernel releases. After updating, reboot or restart WSL to load the new kernel.

  3. Audit your observability stack. Identify all tools that reset nftables counters. Common examples include Prometheus exporters, custom monitoring scripts, and security agents. If you have multiple agents reading and resetting simultaneously, the race is more likely. Consolidate resets into a single, serialized process even after patching, as defense-in-depth.

  4. Verify the fix in running systems. Simply installing a kernel package isn’t enough; the kernel must be active. Use uname -r and compare to the fixed commit IDs if your distribution provides them. For custom kernels, check if commit 779c60a5190c or equivalent is present. You can grep the source for the spinlock addition in nft_counter.c if needed.

  5. Don’t rely solely on CVSS scores. Even after NVD assigned a 5.5, this bug might be lower or higher priority in your environment depending on your use of nftables counters. A billing system that resets counters every minute is far more exposed than a static firewall debugged once a year. Triage based on impact, not just a number.

Looking Ahead: When Metrics Become Liabilities

CVE-2026-45897 is a canary in the coal mine for observability-driven infrastructure. As firewalls evolve into programmable data planes, their statistics are no longer debugging aids—they are inputs to automated defense mechanisms. The kernel’s spinlock fix is the right immediate step, but the broader lesson is that any state consumed by automation must be guarded with the same rigor as authentication tokens or encryption keys.

Future kernel work may move toward per-namespace locks or even redesign the counter reset API to avoid the dump-and-reset pattern altogether. For Windows admins, the takeaway is that the boundary between Windows and Linux security is increasingly porous. Every WSL instance, every container, every appliance is a Linux node that needs its kernel patched and its metrics questioned.

In a world where a counter underflow can fool a monitoring system and obscure an attack, trusting the numbers is the first rule of defense. This tiny lock is a reminder that trust must be built into the kernel one spinlock at a time.