DEBIAN-CVE-2026-63913

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-63913
Published: 19 Jul 2026, 16:17
Last modified:21 Jul 2026, 09:00

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
8.2 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jul 2026, 16:17
Published
Vulnerability first disclosed
21 Jul 2026, 09:00
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

CVSS Metrics

  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected Systems

  • debian•linux

    < 5.10.259-1 | < 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1

References (1)