CVE-2026-68118

Received Received - Intake

TCP Reset Handling Flaw in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped. Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-23

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68118

EUVD

EUVD-2026-55499

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of TCP reset (RST) packets in the SYN-RECEIVED state. Normally, an exact RST should reset the connection, while a non-exact in-window RST should trigger a challenge ACK and be dropped. The flaw allows a non-exact RST to remove the request without eliciting a challenge ACK, violating RFC 9293 section 3.10.7.4.

Detection Guidance

This vulnerability involves improper handling of RST packets in the SYN-RECEIVED state of TCP connections. Detection requires monitoring for unexpected challenge ACK responses or connection resets that do not follow RFC 9293 standards. Check kernel logs for TCP stack anomalies or use packet capture tools like tcpdump to inspect SYN-RECEIVED state transitions and RST packet handling.

Impact Analysis

This vulnerability could allow attackers to disrupt TCP connections prematurely by sending malformed RST packets. This may lead to denial-of-service conditions, connection resets, or unexpected termination of network services relying on TCP.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a network protocol issue in the Linux kernel related to TCP reset handling, which could potentially impact network security and reliability but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor network traffic for unusual RST packets in SYN-RECEIVED state and ensure RFC 9293 compliance in TCP handling.

Hi! I’m here to help you understand CVE-2026-68118. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70