Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-63913

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in 2006979a15af5404bf932a325357683c0bac1656; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in 6476c17d536dbd321c073242e762ddb2713a1238; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in f5547bebc416d56f56fb5b86dc20aabfa42165a0; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in f206def4e86d810f927ba1d8e322ea72b29bce58; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in b98ab51c45c5608a1c19ce7fd17a3032469bb83f; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in d67c6adee8d1b65330d0174c4c367faba14e80a8; From 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 · fixed in bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a

  • Linux Linux

    2.6.15

  • KernelLinux

    From 2.6.15 · fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.93; From 6.13.0 · fixed in 6.18.35; From 6.19.0 · fixed in 7.0.12

References 8

git.kernel.org