CVE-2026-99283: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99283 is a Denial of Service vulnerability in the Linux kernel's Netfilter connection tracking (conntrack) subsystem, specifically in TCP RST packet handling. The flaw causes conntrack entries for established connections to expire prematurely when non-exact TCP RST packets are processed, disrupting active network connections. It affects Linux kernel versions prior to 6.18.61 and was disclosed on November 7, 2026. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-826 (Premature Release of Resource During Expected Lifetime). The bug originates from commit be0502a3f2e9, which introduced logic to keep conntrack entries in ESTABLISHED state when an in-window RST does not exactly match the expected sequence number, allowing the endpoint to validate the RST via a challenge ACK. However, the timeout selection logic incorrectly applies the TCP_CONNTRACK_CLOSE timeout (10 seconds) based on packet type rather than the resulting state transition — so even when the conntrack entry remains in ESTABLISHED, the short close timeout is applied. An attacker can exploit Linux's per-socket challenge ACK rate limiting: by sending a second non-exact RST after the rate limit suppresses the second challenge ACK, the conntrack entry expires while both TCP endpoints remain established. The fix applies the UNACK timeout for RST packets that leave the conntrack entry in TCP_CONNTRACK_ESTABLISHED, avoiding the aggressive 10-second expiration window (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to prematurely terminate established network connections tracked by the Linux kernel's Netfilter subsystem, resulting in a Denial of Service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems acting as firewalls, NAT gateways, or any Linux host using Netfilter conntrack for stateful packet inspection are at risk of having active TCP sessions silently dropped (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability requires high attack complexity (network-based, no authentication, no user interaction required, but timing-dependent exploitation leveraging TCP challenge ACK rate limiting). The CVSS attack complexity is rated HIGH, reflecting the need to precisely time RST packet delivery relative to the challenge ACK rate limit window. No CISA KEV catalog listing has been observed (Red Hat Advisory, GitHub Advisory).

1. Reconnaissance: Identify target systems running Linux kernel versions prior to 6.18.61 with Netfilter conntrack enabled (e.g., firewalls, NAT gateways, or Linux hosts with nf_conntrack loaded).
2. Establish or identify an active TCP connection: Target an established TCP session tracked by the conntrack subsystem on the victim system.
3. Send a non-exact in-window RST packet: Craft and send a TCP RST packet that falls within the valid sequence window but does not match the exact expected sequence number, causing conntrack to keep the entry in ESTABLISHED state but apply the 10-second CLOSE timeout.
4. Wait for challenge ACK rate limit: Allow the victim endpoint to send a challenge ACK (restoring the timeout), then wait until the per-socket challenge ACK rate limit is active.
5. Send a second non-exact RST: Send another non-exact RST packet before the rate limit expires; the endpoint suppresses the second challenge ACK, and the conntrack entry expires after 10 seconds while both TCP endpoints remain established, dropping the tracked connection (Red Hat Bugzilla).

• Network: Unusual TCP RST packets targeting established connections with sequence numbers that are in-window but not exact matches; repeated RST packets sent in rapid succession to the same connection tuple.
• Logs: Kernel logs (dmesg or /var/log/kern.log) showing conntrack entries expiring unexpectedly for connections that remain active at the application layer; Netfilter conntrack table entries disappearing for established sessions.
• Process/System: Unexpected connection drops reported by applications despite both endpoints being reachable; conntrack -L output showing established sessions disappearing prematurely; increased rate of INVALID state packets in Netfilter logs following RST injection.

The primary remediation is to update the Linux kernel to version 6.18.61 or later, which applies the fix (commits 0c6d33329960b2d884a399196c8403643d8a9de6 and bf80e6802273a900311b44e47c9b1a59c6d2473c) that uses the UNACK timeout instead of the CLOSE timeout for non-closing RST packets (GitHub Advisory, Red Hat Bugzilla). As a network-level workaround, implement ingress filtering (BCP38) to reduce exposure to spoofed TCP RST packets from external sources. Monitor for unusual connection terminations that may indicate exploitation attempts while patching is pending.

The vulnerability was announced via the Linux kernel CVE mailing list and picked up by standard vulnerability aggregators including VulDB, ENISA EUVD, and OSV/Debian. Red Hat filed a Bugzilla entry and assigned a low severity rating. No notable independent researcher commentary or significant media coverage beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).