CVE-2026-53151

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel AF_RXRPC

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53151

EUVD

EUVD-2026-39242

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.2 (inc) to 6.6.144 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's rxrpc component, specifically in the ACK parser that handles the SACK (Selective Acknowledgement) table. The issue involves improper handling and modification of the received skbuff (socket buffer) in the function rxrpc_input_soft_acks().

The vulnerability arises because AF_RXRPC assumes it can call skb_condense() to flatten the buffer and then access the SACK table directly from skb->data. However, skb_condense() can fail silently under certain conditions, especially with fragmented UDP packets, leading to potential incorrect access or modification of the buffer.

Additionally, the function rxrpc_input_ack() unnecessarily calls skb_condense(), which is not needed and could contribute to the problem. The vulnerability was fixed by correcting the ACK parser to properly extract the SACK table without relying on skb_condense() and by fixing the modification of the skbuff.

Impact Analysis

This vulnerability could lead to incorrect parsing and handling of network packets within the rxrpc protocol in the Linux kernel. Specifically, it may cause improper access or modification of fragmented UDP packet buffers.

An attacker might exploit this by deliberately crafting fragmented UDP packets to trigger the faulty parsing logic, potentially causing unexpected behavior such as data corruption, denial of service, or other stability issues in the kernel's network stack.

Mitigation Strategies

The vulnerability has been resolved by fixing the ACK parser in the Linux kernel's rxrpc module. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70