CVE-2026-63913 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
8.2
Analyse sur rafaelpfister.ch
Description de l'éditeur (en anglais)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
An unintended behavior in the TCP conntrack state machine allows a
connection to be forced into the CLOSE state using an RST packet with an
invalid sequence number.
Specifically, after a SYN packet is observed, an RST with an invalid SEQ
can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of
whether the RST corresponds to the expected reply direction. The relevant
code path assumes the RST is a response to an outgoing SYN, but does not
validate packet direction or ensure that a matching SYN was actually sent
in the opposite direction.
As a result, a crafted packet sequence consisting of a SYN followed by an
invalid-sequence RST can prematurely terminate an active NAT entry. This
makes connection teardown easier than intended.
So, tighten the state transition logic to ensure that RST-triggered
CLOSE transitions only occur when the RST is a valid response to a
previously observed SYN in the correct direction. Données de référence
- Éditeur
- Linux
- Produits concernés
- Linux
- CVSS 3.1
- 8.2 (HIGH)
- Vecteur
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H- Type de faiblesse
- CWE-20: Improper Input Validation
- Publiée
- 19 juillet 2026
