# CVE-2026-63913 — Linux

> As of 2026-08-05, CVE-2026-63913 is a HIGH-severity vulnerability in Linux, CVSS v3.1 8.2, EPSS 0.9% (60.8th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-63913, most recently “NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS (CVE-2026-56181, CVE-2026-63913)”.

**Last updated:** 2026-08-05

## What is CVE-2026-63913?

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 90 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 8.2 — HIGH (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H`)
- **EPSS (FIRST):** 0.9% probability of exploitation in the next 30 days, higher than 60.8% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-07-19, last modified 2026-08-05

## Is CVE-2026-63913 being exploited?

It currently carries a trending score of 29 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Linux](https://intel.threadlinqs.com/vendors/linux): Linux

## How to fix CVE-2026-63913

No vendor patch reference has been recorded for CVE-2026-63913 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-63913

1 tracked threat in the Threadlinqs corpus references CVE-2026-63913, either in the campaign’s CVE list or as an indicator on the campaign record.

- [NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS (CVE-2026-56181, CVE-2026-63913)](https://intel.threadlinqs.com/threat/TL-2026-1927) — HIGH · 2026-08-07

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-10-10.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656)
- [git.kernel.org (6476c17d536dbd321c073242e762ddb2713a1238)](https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238)
- [git.kernel.org (f5547bebc416d56f56fb5b86dc20aabfa42165a0)](https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0)
- [git.kernel.org (2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77)](https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77)
- [git.kernel.org (f206def4e86d810f927ba1d8e322ea72b29bce58)](https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58)

_Showing 5 of 8 recorded references._

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-63913
Full detection coverage and IOCs for threats exploiting CVE-2026-63913 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp