GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68118 (GCVE-0-2026-68118)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-23 12:45
VLAI
Title
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped. Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 282f23c6ee343126156dd41218b22ece96d747e3 , < 8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49 (git)
Affected: 282f23c6ee343126156dd41218b22ece96d747e3 , < 0fe4636665d14a258de70b4f3e8248e6d42038f1 (git)
Affected: 282f23c6ee343126156dd41218b22ece96d747e3 , < 234f9ffbd9b2c1b24ec67200ea3cff07401bec48 (git)
Affected: 282f23c6ee343126156dd41218b22ece96d747e3 , < 22cec809b048495310f206d9abbcdbbfbdce3ae3 (git)
Affected: 282f23c6ee343126156dd41218b22ece96d747e3 , < a28c4fcbf774e23b4779cae468e3497a5ad1f4a1 (git)
Affected: 86791bbfe5ed7b275be040cfeff049a1624af1b7 (git)
Affected: 61f69dc4e40e41b0018f00fa4aeb23d3239556fb (git)
Affected: 34fb350281ced2a72707a5c0064f69992d440edb (git)
Affected: 3.0.58 , < 3.1 (semver)
Affected: 3.2.37 , < 3.3 (semver)
Affected: 3.4.25 , < 3.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.6
Unaffected: 0 , < 3.6 (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_minisocks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "0fe4636665d14a258de70b4f3e8248e6d42038f1",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "234f9ffbd9b2c1b24ec67200ea3cff07401bec48",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "22cec809b048495310f206d9abbcdbbfbdce3ae3",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "a28c4fcbf774e23b4779cae468e3497a5ad1f4a1",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "86791bbfe5ed7b275be040cfeff049a1624af1b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61f69dc4e40e41b0018f00fa4aeb23d3239556fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34fb350281ced2a72707a5c0064f69992d440edb",
              "versionType": "git"
            },
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "3.0.58",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.37",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.25",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_minisocks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.0.58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order.  Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it.  Use the request socket\u0027s send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in tcp_check_req() on the core TCP receive path (ip_rcv/tcp_v4_rcv or tcp_v6_rcv \u2192 __inet_lookup_skb on TCP_NEW_SYN_RECV \u2192 tcp_check_req); any remote host that can deliver TCP segments to an internet-facing listener reaches it with no local access.\nAC:L - An attacker controls the forged RST (source/dest ports, SEQ sweep across the SYN-RECEIVED window up to tcp_synack_window/65535) and can retry on every handshake; no race, rare config, or victim-only state outside attacker influence is required beyond routine IP spoofing or on-path delivery.\nPR:N - Processing occurs on the pre-authentication TCP handshake path for embryonic request sockets; no credentials, capabilities, or local account are needed\u2014only the ability to send (or spoof) TCP packets to the target listener.\nUI:N - Handshake teardown is triggered automatically when the kernel receives the crafted RST during SYN-RECEIVED; no victim must open files, click links, or perform any other action.\nS:U - Impact is confined to incorrect TCP connection-state handling within the same host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:N - This is a protocol state-machine logic flaw with no memory corruption, out-of-bounds access, use-after-free, or information disclosure\u2014only embryonic request-socket teardown occurs.\nI:L - A non-exact in-window RST causes unauthorized modification of TCP connection state by dropping the embryonic request socket (embryonic_reset/inet_csk_reqsk_queue_drop) instead of preserving it per RFC 5961/RFC 9293.\nA:H - Repeated spoofed in-window RSTs during SYN-RECEIVED can prevent TCP handshakes from completing on arbitrary listening services (HTTPS, SSH, databases, load balancers), causing sustained denial of service without kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:51.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48"
        },
        {
          "url": "https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1"
        }
      ],
      "title": "tcp: challenge ACK for non-exact RST in SYN-RECEIVED",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68118",
    "datePublished": "2026-08-10T11:58:38.000Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-23T12:45:51.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68118",
      "date": "2026-09-15",
      "epss": "0.00391",
      "percentile": "0.32725"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68118\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:56.850\",\"lastModified\":\"2026-08-23T13:16:33.210\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\\n\\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A\\nnon-exact RST therefore removes the request instead of eliciting a\\nchallenge ACK.\\n\\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\\nin-window RST must trigger a challenge ACK and be dropped.\\n\\nApply that check before the ACK-field validation, following the RFC\\nsequence-number, RST, then ACK processing order.  Factor the per-netns\\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\\ncan share it.  Use the request socket\u0027s send_ack() callback and its own\\nout-of-window ACK timestamp to send and rate-limit the response.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/tcp.h\",\"net/ipv4/tcp_input.c\",\"net/ipv4/tcp_minisocks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"282f23c6ee343126156dd41218b22ece96d747e3\",\"lessThan\":\"8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"282f23c6ee343126156dd41218b22ece96d747e3\",\"lessThan\":\"0fe4636665d14a258de70b4f3e8248e6d42038f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"282f23c6ee343126156dd41218b22ece96d747e3\",\"lessThan\":\"234f9ffbd9b2c1b24ec67200ea3cff07401bec48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"282f23c6ee343126156dd41218b22ece96d747e3\",\"lessThan\":\"22cec809b048495310f206d9abbcdbbfbdce3ae3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"282f23c6ee343126156dd41218b22ece96d747e3\",\"lessThan\":\"a28c4fcbf774e23b4779cae468e3497a5ad1f4a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"86791bbfe5ed7b275be040cfeff049a1624af1b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61f69dc4e40e41b0018f00fa4aeb23d3239556fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34fb350281ced2a72707a5c0064f69992d440edb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.0.58\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.2.37\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.25\",\"lessThan\":\"3.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/tcp.h\",\"net/ipv4/tcp_input.c\",\"net/ipv4/tcp_minisocks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:16:26+00:00",
      "cve": "CVE-2026-68118",
      "id": "CVE-2026-68118",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "262",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: challenge ACK for non-exact RST in SYN-RECEIVED",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68118.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-15T01:42:09Z",
      "cve": "CVE-2026-68118",
      "id": "CVE-2026-68118",
      "initial_release_date": "2026-08-13T16:24:13Z",
      "product_status:known_affected": "374",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68118",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68118.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.