CVE-2026-63913
Received Received - Intake

TCP Connection Tracking State Bypass in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63913
EUVD
EUVD-2026-45686

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the TCP connection tracking (conntrack) state machine. It allows an attacker to prematurely close a TCP connection by sending a Reset (RST) packet with an invalid sequence number after observing a SYN packet. The issue occurs because the kernel does not properly validate the direction of the RST packet relative to the SYN, leading to incorrect state transitions.

Detection Guidance

Detecting this vulnerability requires monitoring TCP connection states and RST packet handling in the Linux kernel. Check kernel logs for unexpected TCP_CONNTRACK_CLOSE transitions or RST packets with invalid sequence numbers. Use tools like tcpdump to capture SYN followed by invalid-seq RST packets. Inspect conntrack entries with 'conntrack -L' to identify premature CLOSE states.

Impact Analysis

This vulnerability could allow an attacker to disrupt active network connections by forcing them into a closed state. This may result in interrupted services, failed data transfers, or denial of service for legitimate users relying on those connections.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It primarily impacts network connection tracking in the Linux kernel, which could lead to unintended termination of active connections. Compliance implications would depend on how the affected system is used in a specific environment.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this conntrack TCP state machine vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart