Executive brief
The Linux kernel's TCP implementation did not properly validate incoming reset (RST) packets during connection establishment, allowing attackers to prematurely close connections that should remain open. This can disrupt legitimate network communications and may be chained with other techniques to enable denial-of-service attacks against services relying on TCP connections.
Technical details
The vulnerability exists in the TCP state machine handling for SYN-RECEIVED connections (tcp_check_req()). The kernel accepted in-window RST packets without requiring an exact sequence number match (SEG.SEQ != RCV.NXT), violating RFC 9293 section 3.10.7.4 and RFC 5961. Per the RFCs, only exact-match RSTs should reset the connection; non-exact in-window RSTs must trigger a challenge ACK and be dropped. A network-adjacent attacker can send a crafted RST packet during the three-way handshake to prematurely terminate request sockets. The fix applies strict sequence validation before ACK-field processing and factors out the challenge ACK quota mechanism for request sockets. This is a network-reachable vulnerability requiring no authentication or user interaction.
Affected products
- Linux Linux kernel 2.6.11 through 6.x (before patched versions)
Timeline
- 2026-08-10: disclosed: Published in NVD
- 2026-08-09: patched: Upstream commit a28c4fcbf774e23b4779cae468e3497a5ad1f4a1 by Yuxiang Yang