CVE-2026-68118

A flaw was found in the Linux kernel's handling of TCP (Transmission Control Protocol) connections. A remote attacker could send a specially crafted TCP Reset (RST) packet during the SYN-RECEIVED state. This could cause the system to prematurely remove connection requests instead of issuing a challenge acknowledgment (ACK), potentially leading to a denial of service (DoS) by disrupting the establishment of new network connections.

The TCP SYN-RECEIVED request socket path could accept a non-exact in-window RST and remove the pending request instead of replying with a challenge ACK. A remote attacker may use crafted or spoofed TCP RST packets to disrupt connection establishment for a victim flow if the attacker can match the 4-tuple, hit the SYN-RECEIVED timing window, and place SEG.SEQ inside the receive window. For the CVSS the PR:N is used because no authenticated user privileges are needed beyond network packet injection capability. The issue is network reachable, but reliable blind exploitation has high complexity due to tuple, timing, and sequence requirements. Impact is denial of service against TCP connection setup. For the paranoid score, availability is treated as high because repeated successful resets could degrade service availability, while confidentiality and integrity remain none because this is a protocol validation bug without a memory corruption or data disclosure primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.