CVE-2026-63913
Vulnérabilité élevée dans Linux (Linux)
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
Gravité et risque d'exploitation
CVE-2026-63913 obtient un score CVSS de 8.2/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.97 %, ce qui la place devant 61.3 % des CVE référencées.
Que faire ?
- Vérifiez si Linux (versions <=6.1.*, <=7.0.*, <=6.12.*, <f5547bebc416d56f56fb5b86dc20aabfa42165a0, 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1, <b98ab51c45c5608a1c19ce7fd17a3032469bb83f, 6.12.93, 0, <f206def4e86d810f927ba1d8e322ea72b29bce58, 6.18.35, 6.1.176, 5.15.210, <=5.10.*, <=6.6.*, <2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77, <6476c17d536dbd321c073242e762ddb2713a1238, 7.1, <2.6.15, <=6.18.*, <d67c6adee8d1b65330d0174c4c367faba14e80a8, <bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a, <2006979a15af5404bf932a325357683c0bac1656, 2.6.15, 7.0.12, <=*, <=5.15.*, 6.6.143, 5.10.259) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656
- https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238
- https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0
- https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77
- https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58
- https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f
- https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8
- https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a