cve 2026 68118

CVE-2026-68118 is a Linux TCP vulnerability that allows a forged in-window reset packet to terminate a connection request before the three-way handshake completes. For Windows users, the primary concern is WSL 2, which runs a real Linux kernel in a managed VM. Microsoft's most recent WSL kernel release, 6.18.26.3, predates the upstream 6.18.42 fix identified by the CVE record. The National Vulnerability Database added the record on August 10, 2026, with kernel.org as the source. The flaw affects the tcp_check_req() path, which accepted a TCP RST while a server-side connection was in SYN-RECEIVED state. Users should update their WSL kernel to a patched version.