What is CVE-2026-63913?
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 90 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 8.2 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS (FIRST)
- 0.9% probability of exploitation in the next 30 days, higher than 60.8% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-07-19, last modified 2026-08-05
Is CVE-2026-63913 being exploited?
It currently carries a trending score of 29 in the Threadlinqs vulnerability feed.
Affected products and versions
- Linux: Linux
How to fix CVE-2026-63913
No vendor patch reference has been recorded for CVE-2026-63913 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-63913
1 tracked threat in the Threadlinqs corpus references CVE-2026-63913, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on .
Other references
- git.kernel.org
- git.kernel.org (6476c17d536dbd321c073242e762ddb2713a1238)
- git.kernel.org (f5547bebc416d56f56fb5b86dc20aabfa42165a0)
- git.kernel.org (2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77)
- git.kernel.org (f206def4e86d810f927ba1d8e322ea72b29bce58)
Showing 5 of 8 recorded references.