SB2026110838 - Improper control of a resource through its lifetime in Linux kernel netfilter

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-99283)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by prematurely expiring connection-tracking entries for established TCP connections.

The vulnerability exists due to improper control of connection-tracking entry lifetimes in the Linux kernel netfilter TCP connection-tracking component when processing RST packets that do not close an established connection. A remote attacker can send successive in-window RST packets with non-exact sequence numbers to force a 10-second timeout while per-socket challenge ACK rate limiting suppresses a subsequent response, allowing the connection-tracking entry to expire while both TCP endpoints remain established and potentially disrupting the connection.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c6d33329960b2d884a399196c8403643d8a9de6
• https://git.kernel.org/stable/c/bf80e6802273a900311b44e47c9b1a59c6d2473c