Executive brief
A race condition was identified in the Linux kernel's Netfilter subsystem, which manages network traffic filtering and logging. When multiple administrative requests attempt to read and reset traffic counters simultaneously, the system may incorrectly calculate values, leading to data inaccuracies. While this does not directly allow for remote hacking, it can compromise the integrity of network monitoring and auditing data used by administrators.
Technical details
A race condition exists in the netfilter nft_counter component of the Linux kernel. The vulnerability stems from a lack of synchronization between counter fetch and reset operations during 'dump-and-reset' requests. Specifically, two parallel reset operations could both read the same counter values before either had performed the subtraction, leading to an underrun of the counter values. This has been resolved by introducing a global static spinlock (nft_counter_lock) to serialize these operations within the control plane. The fix ensures that the fetch and reset steps are atomic relative to other administrative reset requests.
Affected products
- Linux Linux Kernel All versions prior to the fix in nft_counter.c
Timeline
- 2026-02-17: patched: Initial patch committed to the main tree.
- 2026-05-27: disclosed: CVE published to the NVD.