{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "282f23c6ee343126156dd41218b22ece96d747e3"
            },
            {
              "fixed": "8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49"
            },
            {
              "fixed": "0fe4636665d14a258de70b4f3e8248e6d42038f1"
            },
            {
              "fixed": "234f9ffbd9b2c1b24ec67200ea3cff07401bec48"
            },
            {
              "fixed": "22cec809b048495310f206d9abbcdbbfbdce3ae3"
            },
            {
              "fixed": "a28c4fcbf774e23b4779cae468e3497a5ad1f4a1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "86791bbfe5ed7b275be040cfeff049a1624af1b7"
            },
            {
              "last_affected": "61f69dc4e40e41b0018f00fa4aeb23d3239556fb"
            },
            {
              "last_affected": "34fb350281ced2a72707a5c0064f69992d440edb"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "3.0.58"
            },
            {
              "fixed": "3.1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "3.2.37"
            },
            {
              "fixed": "3.3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "3.4.25"
            },
            {
              "fixed": "3.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "6.6.153"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.105"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68118.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order.  Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it.  Use the request socket's send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response.",
  "id": "CVE-2026-68118",
  "modified": "2026-08-25T03:51:41.970641613Z",
  "published": "2026-08-10T11:58:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68118.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68118"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "tcp: challenge ACK for non-exact RST in SYN-RECEIVED"
}