Look up another CVE · open CVE-2026-63913 in the interactive tracker
CVE-2026-63913
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63913 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/netfilter/nf_conntrack_proto_tcp.c
- What this is
- NETFILTERMAINTAINERS section matched on net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
- Kernel module
- nf_conntrack
Check it on the machine
grep -wE 'CONFIG_NETFILTER|CONFIG_NF_CONNTRACK' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nf_conntrackPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NETFILTER, CONFIG_NF_CONNTRACK
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.97%, higher than 61.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/netfilter
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.15 | 5.10.259 | 2006979a15af |
| 2.6.15 | 5.15.210 | 6476c17d536d |
| 2.6.15 | 6.1.176 | f5547bebc416 |
| 2.6.15 | 6.6.143 | 2bb6d82b586e |
| 2.6.15 | 6.12.93 | f206def4e86d |
| 2.6.15 | 6.18.35 | b98ab51c45c5 |
| 2.6.15 | 7.0.12 | d67c6adee8d1 |
| 2.6.15 | 7.1 | bed6e04be8e6 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.
- AC:LAttack complexity, low
- The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.
- PR:NPrivileges required, none
- Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.
- UI:NUser interaction, none
- No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.
- S:UScope, unchanged
- Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.
- C:NConfidentiality impact, none
- This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.
- I:LIntegrity impact, low
- The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.
- A:HAvailability impact, high
- Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls.