linux

linux-aws

linux-azure

linux-lts-xenial

linux-aws-hwe

linux-gcp

linux-hwe

linux-hwe-edge

linux-kvm

linux-oracle

linux-fips

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure-4.15

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp-4.15

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe-5.4

linux-ibm-5.4

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux-aws-fips

linux-azure-fips

linux-gcp-fips

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

A vulnerability in the Linux kernel's netfilter conntrack TCP state machine allows an attacker to prematurely force a connection into the CLOSE state by sending a crafted RST packet with an invalid sequence number without proper direction validation. This flaw could cause active NAT entries to be torn down earlier than intended, potentially disrupting network connections. The issue has been fixed in several Linux kernel versions starting with 5.15.0-1117.124~20.04.1 and related releases.

CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check in Linux kernel

A vulnerability in the Linux kernel's netfilter conntrack TCP state machine allowed an attacker to prematurely force a connection into the CLOSE state by sending a crafted RST packet with an invalid sequence number. This could cause active NAT entries to be torn down earlier than intended. The issue has been fixed in patched Linux kernel versions. The vulnerability has a CVSS score of 8.2 and affects multiple Linux kernel versions prior to 7.0.0-28.28~24.04.1 and related builds.

CVE-2026-63913 is a vulnerability in the Linux kernel's netfilter conntrack TCP state machine. It allows a crafted RST packet with an invalid sequence number to prematurely force a connection into the CLOSE state without verifying the packet direction. This flaw can cause active NAT connection entries to be torn down earlier than intended.

Search: CVE-2026-63913