Improper control of a resource through its lifetime in Linux kernel - CVE-2026-99283

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by prematurely expiring connection-tracking entries for established TCP connections.

The vulnerability exists due to improper control of connection-tracking entry lifetimes in the Linux kernel netfilter TCP connection-tracking component when processing RST packets that do not close an established connection. A remote attacker can send successive in-window RST packets with non-exact sequence numbers to force a 10-second timeout while per-socket challenge ACK rate limiting suppresses a subsequent response, allowing the connection-tracking entry to expire while both TCP endpoints remain established and potentially disrupting the connection.

Affected software

How to mitigate CVE-2026-99283

External References

• https://git.kernel.org/stable/c/0c6d33329960b2d884a399196c8403643d8a9de6
• https://git.kernel.org/stable/c/bf80e6802273a900311b44e47c9b1a59c6d2473c

Related Security Bulletins

• Improper control of a resource through its lifetime in Linux kernel netfilter
• Debian update for linux