CVE-2026-53151
published 2026-06-25CVE-2026-53151: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.50%
39.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.
Note that whilst rxrpc_input_soft_acks() should be able to parse extended
ACKs, the rest of AF_RXRPC doesn't currently support that.
Further, there's then no need to call skb_condense() in rxrpc_input_ack(),
so don't.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= d57a3a151660902091491ac2633134e1be92557f < 5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1 | 5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1 |
| linux | linux | >= d57a3a151660902091491ac2633134e1be92557f < 775c5e89272a2615b72bb84f611ba66fa3b7493e | 775c5e89272a2615b72bb84f611ba66fa3b7493e |
| linux | linux | >= d57a3a151660902091491ac2633134e1be92557f < 566c4c1244de50fbff1f89ff93c9d7b0fc256db4 | 566c4c1244de50fbff1f89ff93c9d7b0fc256db4 |
| linux | linux | >= d57a3a151660902091491ac2633134e1be92557f < 224298450be5c04d2a6ea1c2a94669d7ebf65d00 | 224298450be5c04d2a6ea1c2a94669d7ebf65d00 |
| linux | linux | >= d57a3a151660902091491ac2633134e1be92557f < 333b6d5bb9f87827ac2639c737bf9613dbae7253 | 333b6d5bb9f87827ac2639c737bf9613dbae7253 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.35/7.0.12 rxrpc rxrpc_input_soft_acks data buffer overflow (Nessus ID 323577 / WID-SEC-2026-2077)
vuldb·2026-06-29·CVSS 9.8
CVE-2026-53151 [CRITICAL] Linux Kernel up to 6.18.35/7.0.12 rxrpc rxrpc_input_soft_acks data buffer overflow (Nessus ID 323577 / WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 6.18.35/7.0.12. It has been rated as critical. Affected by this issue is the function rxrpc_input_soft_acks of the component rxrpc. Performing a manipulation of the argument data results in buffer overflow.
This vulnerability is reported as CVE-2026-53151. The attacker must have access to the local network to execute the attack. No exploit exists.
Upgrading the affected component is advised.
GHSA
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks()
ghsa_unreviewed·2026-06-25
CVE-2026-53151 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks()
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.
Note that whilst rxrpc_input_soft_acks() should be able to parse extende
Red Hat
kernel: rxrpc: Fix the ACK parser to extract the SACK table for parsing
vendor_redhat·2026-06-25·CVSS 5.5
CVE-2026-53151 [MEDIUM] CWE-125 kernel: rxrpc: Fix the ACK parser to extract the SACK table for parsing
kernel: rxrpc: Fix the ACK parser to extract the SACK table for parsing
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.
Not
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00https://git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4https://git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1https://git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493e
2026-06-25
Published