CVE-2026-63913

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63913", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.020Z", "datePublished": "2026-07-19T14:55:17.917Z", "dateUpdated": "2026-10-19T20:17:55.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:07.250Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "versions": [{"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "2006979a15af5404bf932a325357683c0bac1656", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "6476c17d536dbd321c073242e762ddb2713a1238", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8", "status": "affected", "versionType": "git"}, {"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "versions": [{"version": "2.6.15", "status": "affected"}, {"version": "0", "lessThan": "2.6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"}, {"url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"}, {"url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"}, {"url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"}, {"url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"}, {"url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"}, {"url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"}, {"url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"}], "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:11.442709Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:17:55.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:11.442709Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:33:12.008Z"}}], "cna": {"title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "2006979a15af5404bf932a325357683c0bac1656", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "6476c17d536dbd321c073242e762ddb2713a1238", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8", "versionType": "git"}, {"status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a", "versionType": "git"}], "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.15"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"}, {"url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"}, {"url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"}, {"url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"}, {"url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"}, {"url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"}, {"url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"}, {"url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "2.6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:07.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63913", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:17:55.476Z", "dateReserved": "2026-07-19T07:54:57.020Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:55:17.917Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2006979a15af5404bf932a325357683c0bac1656", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "6476c17d536dbd321c073242e762ddb2713a1238", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}, {"lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a", "status": "affected", "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_proto_tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.15"}, {"lessThan": "2.6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83AFCE02-A944-4709-817B-357BAB817063", "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."}], "id": "CVE-2026-63913", "lastModified": "2026-10-30T17:55:50.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63913", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:33:11.442709Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:09.237", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check", "id": "2502438", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-358", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction.", "A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP (Transmission Control Protocol) packets, specifically a SYN (synchronize) packet followed by an RST (reset) packet with an invalid sequence number. This improper handling of the RST packet can prematurely terminate an active Network Address Translation (NAT) entry, making connection teardown easier than intended and potentially leading to a denial of service for affected connections."], "name": "CVE-2026-63913", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63913\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63913\nhttps://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63913-9646@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,2006979a15af5404bf932a325357683c0bac1656)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,6476c17d536dbd321c073242e762ddb2713a1238)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,f5547bebc416d56f56fb5b86dc20aabfa42165a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,f206def4e86d810f927ba1d8e322ea72b29bce58)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,b98ab51c45c5608a1c19ce7fd17a3032469bb83f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,d67c6adee8d1b65330d0174c4c367faba14e80a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1,bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.259,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.210,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.176,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.143,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.93,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.35,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.12,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T04:30:17.180854+00:00", "updated": "2026-10-20T09:15:12.787723+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}