CVE-2026-68118: Linux Kernel TCP DoS Vulnerability

CVE-2026-68118 Overview

CVE-2026-68118 is a Linux kernel TCP protocol vulnerability in the SYN-RECEIVED request-socket path. The tcp_check_req() function accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST removes the pending request instead of eliciting a challenge ACK. This behavior deviates from RFC 9293 section 3.10.7.4, which applies the RFC 5961 reset check in SYN-RECEIVED state. The flaw enables off-path attackers to terminate half-open TCP connections by guessing a sequence number within the receive window rather than the exact expected value.

Critical Impact
Remote attackers can disrupt TCP connection establishment by injecting in-window RST packets, causing denial of service against services accepting new connections.

Affected Products

Linux kernel TCP stack (net/ipv4/tcp_input.c, tcp_check_req() path)
Distributions shipping affected upstream kernel versions
Systems accepting inbound TCP connections in SYN-RECEIVED state

Discovery Timeline

2026-08-10 - CVE-2026-68118 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68118

Vulnerability Analysis

The vulnerability resides in the Linux kernel TCP state machine, specifically in the request-socket handling for connections in the SYN-RECEIVED state. When a server receives a SYN and replies with a SYN-ACK, it creates a request socket while awaiting the client's final ACK. During this window, the kernel processes incoming segments through tcp_check_req().

RFC 9293 mandates that only an RST whose sequence number exactly equals RCV.NXT may reset a connection. Any other in-window RST must trigger a challenge ACK and be dropped. The Linux implementation skipped this exactness check for request sockets and treated any in-window RST as valid, allowing removal of the pending connection.

An off-path attacker who can guess the four-tuple and any sequence number within the receive window can terminate legitimate handshakes. This weakens the protocol's blind-attack resistance introduced by RFC 5961.

Root Cause

The root cause is missing enforcement of the exact-match sequence check on RST segments in the SYN-RECEIVED request-socket path. The check existed for established sockets via tcp_send_challenge_ack() but was not applied to request sockets. The ACK-field validation also ran before the RST check, violating the RFC-specified sequence-number, RST, then ACK processing order.

Attack Vector

Exploitation requires only network access. An attacker sends a crafted TCP RST segment targeting a server socket in SYN-RECEIVED state. The RST need not carry the exact expected sequence number; any value within the receive window suffices to tear down the half-open connection. Repeated injection prevents clients from completing three-way handshakes, degrading availability of network-facing services.

The fix relocates the RST validation before ACK-field processing, factors the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets share the same rate limit, and uses the request socket's send_ack() callback to emit and rate-limit challenge ACKs.

Detection Methods for CVE-2026-68118

Indicators of Compromise

Elevated counts of TCP RST segments arriving during connection setup phases
Increased ListenDrops or TCPAbortOnData counters in /proc/net/netstat
Client-side connection failures with premature RST reception during handshake
Anomalous RST-to-SYN ratios on public-facing listeners

Detection Strategies

Monitor kernel networking counters for spikes in aborted request sockets
Deploy packet capture at network egress and ingress points to correlate RST floods with handshake failures
Baseline expected RST volume per service and alert on statistical deviation
Correlate source IPs generating disproportionate RST traffic against active flow tables

Monitoring Recommendations

Ingest netfilter and conntrack logs into a centralized analytics platform for longitudinal analysis
Track kernel version and patch state across Linux fleet inventory
Alert when servers report sustained SYN-RECEIVED timeouts without corresponding client abort logs

How to Mitigate CVE-2026-68118

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git commits 22cec809b048, 234f9ffbd9b2, and a28c4fcbf774
Inventory Linux hosts and prioritize patching internet-facing servers accepting inbound TCP connections
Review distribution security advisories for backported fixes matching your kernel branch

Patch Information

The fix applies the RFC 9293 exact-match RST check before ACK-field validation in the SYN-RECEIVED path. It shares the per-netns challenge ACK quota between established and request sockets. See the upstream commits: 22cec809b048, 234f9ffbd9b2, and a28c4fcbf774.

Workarounds

Restrict inbound TCP access to trusted networks using stateful firewall rules where feasible
Deploy TCP SYN cookies and connection rate limits to reduce the exposure window for request sockets
Enable ingress filtering (BCP 38) at network borders to limit spoofed-source RST injection

bash

# Verify running kernel and applied patch level
uname -r
grep -E 'tcp_check_req|challenge_ack' /proc/kallsyms | head

# Check TCP abort and challenge ACK counters
cat /proc/net/netstat | grep -E 'TCPAbort|TCPChallenge'

# Confirm SYN cookies enabled as defense-in-depth
sysctl net.ipv4.tcp_syncookies