CVE-2026-63913netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before 2006979a15af5404bf932a325357683c0bac1656; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before 6476c17d536dbd321c073242e762ddb2713a1238; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before f5547bebc416d56f56fb5b86dc20aabfa42165a0; 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 builds before 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before f206def4e86d810f927ba1d8e322ea72b29bce58; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before b98ab51c45c5608a1c19ce7fd17a3032469bb83f; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before d67c6adee8d1b65330d0174c4c367faba14e80a8; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 before bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a | CNA record |
References
- https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656
- https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238
- https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0
- https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77
- https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58
- https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f
- https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8
- https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.