CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Vulnerability summary
CVE-2026-63913 is a high (CVSS 8.2) Improper Input Validation vulnerability in linux. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities.
Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 35 · Related 32Timeline
- 19-07-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.97%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu167 products
- linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < 2006979a15af5404bf932a325357683c0bac1656 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < 6476c17d536dbd321c073242e762ddb2713a1238 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < f5547bebc416d56f56fb5b86dc20aabfa42165a0 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < f206def4e86d810f927ba1d8e322ea72b29bce58 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < b98ab51c45c5608a1c19ce7fd17a3032469bb83f | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < d67c6adee8d1b65330d0174c4c367faba14e80a8 | ≥ 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, < bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a | 2.6.15
- linux_kernel≥ 2.6.15, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.93 | ≥ 6.13, < 6.18.35 | ≥ 6.19, < 7.0.12 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1
3 vendors · 170 products
