Answer in brief
CVE-2026-63913 records a High severity (CVSS 8.2) vulnerability in netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <2006979a15af5404bf932a325357683c0bac1656 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <6476c17d536dbd321c073242e762ddb2713a1238 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <f5547bebc416d56f56fb5b86dc20aabfa42165a0 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <f206def4e86d810f927ba1d8e322ea72b29bce58 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <b98ab51c45c5608a1c19ce7fd17a3032469bb83f || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <d67c6adee8d1b65330d0174c4c367faba14e80a8 || >=9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 <bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a | 2006979a15af5404bf932a325357683c0bac1656, 6476c17d536dbd321c073242e762ddb2713a1238, f5547bebc416d56f56fb5b86dc20aabfa42165a0, 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77, f206def4e86d810f927ba1d8e322ea72b29bce58, b98ab51c45c5608a1c19ce7fd17a3032469bb83f, d67c6adee8d1b65330d0174c4c367faba14e80a8, bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a |
| Linux/Linuxgeneric | 2.6.15 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
Quoted source text, attributed separately from HOL analysis.