CVE-2026-45897

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_counter: serialize reset with spinlock

Add a global static spinlock to serialize counter fetch+reset

operations, preventing concurrent dump-and-reset from underrunning

values.

The lock is taken before fetching the total so that two parallel

resets cannot both read the same counter values and then both

subtract them.

A global lock is used for simplicity since resets are infrequent.

If this becomes a bottleneck, it can be replaced with a per-net

lock later.