The Linux kernel netfilter conntrack TCP implementation contained a flaw where an RST packet with an invalid sequence number could force a connection into the CLOSE state without verifying the packet's direction or the existence of a corresponding SYN in the opposite direction. This unintended behavior allowed a crafted sequence of a SYN followed by an invalid-sequence RST to prematurely terminate an active NAT connection entry. The fix involves strengthening the state transition logic to validate that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

An attacker capable of sending crafted TCP packets can prematurely terminate active NAT connection tracking entries by exploiting this flaw. This could disrupt legitimate network connections by forcing their teardown earlier than intended. There is no indication of remote code execution or privilege escalation. The impact is limited to connection teardown behavior within the netfilter conntrack subsystem.

A fix for this vulnerability has been implemented in the Linux kernel by tightening the TCP conntrack state machine logic. Users should apply the official Linux kernel updates that address this issue. Since no vendor advisory or patch links are provided here, users should consult their Linux distribution's security advisories for the relevant kernel updates. Patch status is not yet confirmed in this data; verify with vendor advisories for current remediation guidance.