Linux Kernel EUVD-2026-55499

Exploitation requires that the attacker can observe or enumerate a TCP connection in the SYN-RECEIVED state - specifically after the server receives the client SYN but before the three-way handshake completes - on a Linux system running an unpatched kernel version. The attacker must know or accurately guess the connection 4-tuple (source IP, destination IP, source port, destination port) and craft an RST whose sequence number falls within the TCP receive window but does not exactly equal RCV.NXT. On-path adversaries (same network segment, BGP-level, ISP, or MITM position) satisfy this condition trivially; fully blind off-path attackers face the practical challenge of guessing the sequence window without feedback, which substantially raises real-world exploitation difficulty despite the AC:L CVSS rating. No special kernel configuration, non-default feature flag, or unusual deployment mode is required - the vulnerability is present in the default TCP SYN-RECEIVED handling across standard kernel builds. Exploitation is bounded to the brief SYN-RECEIVED state window during handshake and cannot be triggered against already-ESTABLISHED connections.

The CVSS 8.2 High score is driven by the AV:N/AC:L/PR:N/UI:N vector, reflecting that exploitation requires only network access with no authentication or user interaction. In practice, a successful attack requires knowledge of the connection 4-tuple (source and destination IP plus ports) and an in-window RST with a non-exact sequence number - straightforward from an on-path adversary or in environments with predictable ephemeral ports, but substantially harder for a fully blind off-path attacker without traffic visibility. The EPSS score of 0.17% (6th percentile) sharply contrasts with the elevated CVSS, indicating that actual exploitation probability is assessed as very low at time of analysis; even a mid-sized municipal IT team in legnica should treat this as a scheduled patching priority rather than an emergency incident response, given that no active exploitation has been confirmed by CISA or any vendor. The absence of a KEV listing and any identified public POC further suggests this remains a theoretical rather than actively weaponized risk. The high availability impact (A:H) is realistic since aborting SYN-RECEIVED connections could disrupt services under targeted connection-teardown scenarios or under load, but the no-confidentiality (C:N) and low-integrity (I:L) ratings cap the worst-case outcome at service disruption rather than data compromise or privilege escalation.

An attacker with on-path network visibility between a client and a Linux-based TCP server observes a connection in the SYN-RECEIVED state during the three-way handshake and crafts a spoofed RST segment with a sequence number that falls within the receive window but does not exactly match RCV.NXT. The unpatched kernel accepts the RST, removes the half-open request socket without issuing a challenge ACK, and silently aborts the connection establishment - requiring no authentication and no interaction from either legitimate party. No public exploit code has been identified at time of analysis, but the attack is conceptually straightforward for any adversary with traffic visibility on the path.