TCP Timeout Vulnerability in Linux Kernel's Netfilter Component

CVE-2026-99283

What is CVE-2026-99283?

A vulnerability in the Linux kernel's netfilter component concerning TCP connection tracking can cause an expedited expiration of connection entries. The issue arises when the conntrack system incorrectly applies a CLOSE timeout to certain RST packets even when the connection state remains ESTABLISHED. This mismanagement can lead to a scenario where established connections are prematurely expired, disrupting ongoing communications. By implementing the correct UNACK timeout for specific RST packets, this vulnerability can be mitigated, ensuring that malicious actors cannot exploit the timeout mechanism to disrupt TCP sessions.

References