CVE-2026-63913: Linux Kernel Netfilter TCP DoS Vulnerability

CVE-2026-63913 Overview

CVE-2026-63913 is a Linux kernel vulnerability in the netfilter connection tracking (conntrack) TCP state machine. The flaw allows a remote attacker to prematurely terminate active NAT connections by sending a crafted TCP packet sequence. Specifically, after observing a SYN packet, an RST packet with an invalid sequence number can force a conntrack entry into the TCP_CONNTRACK_CLOSE state without validating packet direction. This enables an off-path attacker to tear down established connections traversing Linux-based routers, firewalls, and NAT gateways.

Critical Impact
Attackers can remotely terminate active TCP connections passing through Linux netfilter NAT/firewall systems, disrupting network availability and interrupting services.

Affected Products

Linux kernel netfilter subsystem (nf_conntrack_proto_tcp)
Linux distributions using affected kernel versions with nf_conntrack enabled
Systems performing NAT, stateful firewalling, or connection tracking via netfilter

Discovery Timeline

2026-07-19 - CVE-2026-63913 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63913

Vulnerability Analysis

The vulnerability resides in the TCP conntrack state machine within the Linux kernel netfilter subsystem. The state transition logic treats an RST packet with an invalid sequence number as a valid response to an outgoing SYN. The code path does not verify that the RST arrives from the expected reply direction or that a corresponding SYN was observed in the opposite direction.

As a result, a crafted packet sequence containing a SYN followed by an invalid-sequence RST forces the conntrack entry into TCP_CONNTRACK_CLOSE. This teardown occurs even when the RST would normally be rejected by the endpoint TCP stack. The vulnerability primarily affects connection availability rather than confidentiality, but disrupts NAT sessions used by downstream applications.

Root Cause

The root cause is missing direction validation in the RST handling branch of the TCP state machine. The kernel assumes an RST following a SYN is a legitimate reply to the SYN. It does not confirm that the RST corresponds to the reply direction of the tracked flow. This falls under improper input validation combined with a state machine logic flaw.

Attack Vector

An attacker on the network path, or one able to spoof source addresses, can inject a SYN followed by an RST with an invalid sequence number targeting an existing NAT flow. The netfilter conntrack entry transitions to CLOSE and subsequent legitimate traffic is dropped or forced to renegotiate. This produces denial-of-service conditions for connections routed through affected Linux firewalls, VPN concentrators, or container networking stacks.

The vulnerability mechanism is described in prose because verified proof-of-concept code is not publicly available. Fix commits are referenced in the upstream kernel patches.

Detection Methods for CVE-2026-63913

Indicators of Compromise

Unexpected conntrack entries transitioning to CLOSE shortly after a new SYN, without a preceding valid three-way handshake completion
Elevated rates of RST packets with sequence numbers outside the expected TCP window on ingress interfaces
Sudden termination of long-lived NAT sessions correlated with inbound RST bursts

Detection Strategies

Monitor conntrack -E event streams for anomalous SYN-then-CLOSE transitions on active flows
Deploy IDS or Suricata signatures detecting out-of-window RST packets targeting tracked flows
Correlate netfilter state transition logs with application-layer session termination events to spot forced teardowns

Monitoring Recommendations

Enable nf_conntrack accounting and log state transitions to a centralized SIEM for baseline analysis
Track TCP RST-to-SYN ratios per source IP to identify targeted teardown attempts
Alert on repeated conntrackCLOSE events for connections that never reached ESTABLISHED

How to Mitigate CVE-2026-63913

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
Identify all Linux hosts performing NAT, stateful firewalling, or container networking and prioritize them for patching
Restrict ingress of spoofed traffic by enforcing reverse-path filtering (rp_filter=1) on external interfaces

Patch Information

The fix tightens the RST-triggered state transition logic to require that the RST is a valid response to a previously observed SYN in the correct direction. Patched commits include 2006979a15af, 2bb6d82b586e, 6476c17d536d, b98ab51c45c5, bed6e04be8e6, d67c6adee8d1, f206def4e86d, and f5547bebc416. See the kernel.org stable tree for the merged fixes across supported branches.

Workarounds

Deploy strict ingress filtering to drop TCP RST packets with sequence numbers outside expected windows at the network edge
Use iptables or nftables rules to rate-limit inbound RST packets from untrusted sources
Where feasible, disable nf_conntrack on hosts that do not require stateful tracking to eliminate exposure

bash

# Enable reverse-path filtering and rate-limit inbound RST packets
sysctl -w net.ipv4.conf.all.rp_filter=1
nft add rule inet filter input tcp flags rst limit rate 10/second accept
nft add rule inet filter input tcp flags rst drop