CVE-2026-63913— Linux kernel 安全漏洞

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

N/A

Linux kernel 安全漏洞

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.15版本存在安全漏洞，该漏洞源于netfilter conntrack tcp状态机未进行方向检查，导致无效序列号的RST数据包可将连接强制置为CLOSE状态，从而提前终止活跃的NAT连接。

N/A

N/A