CVE-2026-68118

tcp: challenge ACK for non-exact RST in SYN-RECEIVED

State: Published
Severity: 8.2 High
Published: Aug 10, 2026
Updated: Oct 30, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: challenge ACK for non-exact RST in SYN-RECEIVED

The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK.

RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped.

Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	282f23c6ee343126156dd41218b22ece96d747e3 to before c5dc463cc60eb26079b19607c9dbda76491dad05Affected 282f23c6ee343126156dd41218b22ece96d747e3 to before 8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49Affected 282f23c6ee343126156dd41218b22ece96d747e3 to before 0fe4636665d14a258de70b4f3e8248e6d42038f1Affected 282f23c6ee343126156dd41218b22ece96d747e3 to before 234f9ffbd9b2c1b24ec67200ea3cff07401bec48Affected 282f23c6ee343126156dd41218b22ece96d747e3 to before 22cec809b048495310f206d9abbcdbbfbdce3ae3Affected 282f23c6ee343126156dd41218b22ece96d747e3 to before a28c4fcbf774e23b4779cae468e3497a5ad1f4a1Affected 86791bbfe5ed7b275be040cfeff049a1624af1b7Affected 61f69dc4e40e41b0018f00fa4aeb23d3239556fbAffected 34fb350281ced2a72707a5c0064f69992d440edbAffected 3.0.58 to before 3.1Affected 3.2.37 to before 3.3Affected 3.4.25 to before 3.5Affected
LinuxLinux	3.6Affected before 3.6Not affected 6.1.191 through 6.1.Not affected 6.6.153 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

282f23c6ee343126156dd41218b22ece96d747e3 to before c5dc463cc60eb26079b19607c9dbda76491dad05Affected
282f23c6ee343126156dd41218b22ece96d747e3 to before 8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49Affected
282f23c6ee343126156dd41218b22ece96d747e3 to before 0fe4636665d14a258de70b4f3e8248e6d42038f1Affected
282f23c6ee343126156dd41218b22ece96d747e3 to before 234f9ffbd9b2c1b24ec67200ea3cff07401bec48Affected
282f23c6ee343126156dd41218b22ece96d747e3 to before 22cec809b048495310f206d9abbcdbbfbdce3ae3Affected
282f23c6ee343126156dd41218b22ece96d747e3 to before a28c4fcbf774e23b4779cae468e3497a5ad1f4a1Affected
86791bbfe5ed7b275be040cfeff049a1624af1b7Affected
61f69dc4e40e41b0018f00fa4aeb23d3239556fbAffected
34fb350281ced2a72707a5c0064f69992d440edbAffected
3.0.58 to before 3.1Affected
3.2.37 to before 3.3Affected
3.4.25 to before 3.5Affected

LinuxLinux

3.6Affected
before 3.6Not affected
6.1.191 through 6.1.*Not affected
6.6.153 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.