---
id: CVE-2026-68118
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: challenge ACK for non-exact RST in SYN-RECEIVED

  The SYN-RECEIVED request-socket path in tcp_check_req() accepts an
  in-window RST without requiring SEG.SEQ to exac…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: challenge ACK for non-exact RST in SYN-RECEIVED

  The SYN-RECEIVED request-socket path in tcp_check_req() accepts an
  in-window RST without requiring SEG.SEQ to exac…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
published: '2026-08-10'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68118'
references:
  - url: 'https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0056
epssPercentile: 0.44238
ingestedAt: '2026-08-23T13:48:06.076Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: challenge ACK for non-exact RST in SYN-RECEIVED

The SYN-RECEIVED request-socket path in tcp_check_req() accepts an
in-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A
non-exact RST therefore removes the request instead of eliciting a
challenge ACK.

RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in
SYN-RECEIVED: an exact RST resets the connection, while a non-exact
in-window RST must trigger a challenge ACK and be dropped.

Apply that check before the ACK-field validation, following the RFC
sequence-number, RST, then ACK processing order.  Factor the per-netns
challenge ACK quota out of tcp_send_challenge_ack() so request sockets
can share it.  Use the request socket's send_ack() callback and its own
out-of-window ACK timestamp to send and rate-limit the response.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.