CVE-2026-45873

What it actually does

This is a local denial-of-service vulnerability in the Linux kernel netfilter nf_tables rbtree set implementation. The flaw is in validation of interval-based anonymous sets: userspace can submit overlapping interval definitions that are not rejected correctly when start elements partially overlap. If accepted, the kernel may build an inconsistent nftables set/ruleset state, potentially triggering kernel faults, crashes, or other availability-impacting behavior when the set is evaluated or manipulated. Exploitation requires local privileges sufficient to interact with nf_tables, commonly CAP_NET_ADMIN or access through a namespace configuration that grants nftables administration rights.

Why it matters to the business

Successful exploitation can crash or destabilize Linux systems, causing service interruption, node reboots, workload disruption, and potential loss of network filtering functionality. The risk is primarily local rather than remote, and current exploitation signals are low: EPSS is very low, it is not listed in CISA KEV, and no public exploit maturity is reported. Systems that allow untrusted users, containers, or workloads to obtain network administration capabilities are at higher operational risk.

How an attack unfolds

An attacker first obtains local code execution on a Linux host or inside an environment where they can create or administer nftables rules, such as a privileged container, a container with CAP_NET_ADMIN, or a user namespace configuration that exposes nf_tables operations. The attacker then submits a crafted nftables ruleset containing anonymous rbtree interval sets with partially overlapping start elements, for example intervals that share the same start but have different end values. Vulnerable kernels fail to reject the malformed overlap in all cases. Once the malformed set is installed or exercised, the inconsistent kernel-side data structure can lead to a kernel fault or system instability, resulting in denial of service.

How to fix it

Update affected Linux kernels to a vendor-supported release that includes the upstream netfilter fix for nft_set_rbtree partial-overlap validation in anonymous sets. Because fixed package versions were not provided in the input, use the relevant distribution security advisory for exact kernel package names and versions, then reboot into the patched kernel. Where immediate patching is not possible, reduce exposure by limiting CAP_NET_ADMIN, avoiding privileged containers, disabling unprivileged user namespaces where operationally feasible, preventing untrusted users from loading nftables rules, and restricting access to tools such as nft in multi-user or shared compute environments. These mitigations reduce exploitability but do not replace the kernel fix.

How to confirm the fix worked

Confirm that systems are running a kernel build that includes the netfilter nft_set_rbtree overlap-validation patch from the appropriate Linux distribution or kernel vendor. Validate with package-manager metadata, kernel version checks, and advisory mapping rather than version strings alone, because vendors may backport fixes without changing to the latest upstream kernel. After updating, reboot and verify the active kernel is the patched one. As a functional check in a non-production test environment, attempts to load nftables anonymous interval sets with overlapping start elements should be rejected instead of accepted or causing instability. Also review container and namespace settings to confirm untrusted workloads cannot obtain CAP_NET_ADMIN unnecessarily.

Typical attack path

1. Gain local execution on a Linux system or inside a container/workload running on the host.
2. Obtain the ability to interact with nf_tables, typically through CAP_NET_ADMIN, privileged container settings, or permissive user namespace behavior.
3. Create or load a crafted nftables ruleset using anonymous interval sets backed by the rbtree set implementation.
4. Include partially overlapping intervals that should be rejected but are accepted by the vulnerable kernel validation path.
5. Trigger evaluation, modification, or cleanup of the malformed set until the kernel becomes unstable, crashes, or reboots.

How to detect it

To assess possible prior exploitation, review host logs for kernel oops, panic, watchdog, or unexpected reboot events near nftables configuration changes. Useful sources include the kernel ring buffer, system journal, syslog, auditd logs, endpoint telemetry, container runtime logs, and configuration-management records that track firewall rule changes. Look for executions of nft, iptables-nft, or scripts that load nftables rules by accounts or containers that do not normally administer firewalls. In containerized environments, correlate suspicious nftables activity with privileged containers, CAP_NET_ADMIN grants, user namespace creation, and container restarts. Kernel crash dumps, if available, should be inspected for stack traces or symbols involving nf_tables, nft_set_rbtree, rbtree set handling, or interval set validation. Because this vulnerability is a crash/availability issue and does not have a stable public exploit signature, detection should focus on suspicious local nftables manipulation followed by kernel instability rather than a single definitive network IOC.

• nft_set_rbtree
• nf_tables
• nftables
• process=nft
• comm="nft"
• exe="/usr/sbin/nft"
• exe="/sbin/nft"
• iptables-nft
• CAP_NET_ADMIN
• unshare --net
• BUG: kernel NULL pointer dereference
• kernel BUG
• Kernel panic
• Oops:
• watchdog: BUG: soft lockup
• general protection fault
• segfault at
• /proc/net/netfilter
• /etc/nftables.conf

What your security team should do

• Prioritize patching Linux systems where untrusted users, CI jobs, containers, or hosted workloads may have local execution or CAP_NET_ADMIN-like capabilities.
• Inventory hosts using nftables/nf_tables and identify kernels whose vendor advisories indicate exposure to this netfilter rbtree set issue.
• Apply vendor kernel updates and reboot; verify the running kernel, not only the installed package, is fixed.
• Reduce interim exposure by removing CAP_NET_ADMIN from containers and services that do not explicitly require it.
• Disable or restrict unprivileged user namespaces where compatible with business requirements.
• Audit privileged containers, container runtimes, and sandbox profiles for paths that allow nftables manipulation from less-trusted workloads.
• Monitor for kernel crashes, oops reports, unexpected reboots, and suspicious nftables ruleset changes until patching is complete.
• Treat exploitation as a local post-compromise or tenant-escape-enabling denial-of-service risk rather than an internet-facing remote-code-execution issue.