CVE-2026-63913

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state via an RST packet with an invalid sequence number. After a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP CONNTRACK CLOSE without validating the packet direction or confirming a matching SYN was sent in the opposite direction. This allows a crafted packet sequence of a SYN followed by an invalid-sequence RST to prematurely terminate an active NAT entry, facilitating easier connection teardown.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.