CVE-2026-63913

Status: UPDATED  |  Advisory ID: CVE-2026-63913

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

An unintended behavior in the TCP conntrack state machine allows a

connection to be forced into the CLOSE state using an RST packet with an

invalid sequence number.

Specifically, after a SYN packet is observed, an RST with an invalid SEQ

can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of

whether the RST corresponds to the expected reply direction. The relevant

code path assumes the RST is a response to an outgoing SYN, but does not

validate packet direction or ensure that a matching SYN was actually sent

in the opposite direction.

As a result, a crafted packet sequence consisting of a SYN followed by an

invalid-sequence RST can prematurely terminate an active NAT entry. This

makes connection teardown easier than intended.

So, tighten the state transition logic to ensure that RST-triggered

CLOSE transitions only occur when the RST is a valid response to a

previously observed SYN in the correct direction. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References