CVE-2026-53151

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00
https://git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253
https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4
https://git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1
https://git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493e

Configurations

No configuration.

History

04 Jul 2026, 12:16

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1 - () https://git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493e -

28 Jun 2026, 08:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

25 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 09:16

Updated : 2026-07-04 12:16

NVD link : CVE-2026-53151

Mitre link : CVE-2026-53151

CVE.ORG link : CVE-2026-53151

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53151", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d57a3a151660902091491ac2633134e1be92557f", "lessThan": "5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1", "versionType": "git"}, {"status": "affected", "version": "d57a3a151660902091491ac2633134e1be92557f", "lessThan": "775c5e89272a2615b72bb84f611ba66fa3b7493e", "versionType": "git"}, {"status": "affected", "version": "d57a3a151660902091491ac2633134e1be92557f", "lessThan": "566c4c1244de50fbff1f89ff93c9d7b0fc256db4", "versionType": "git"}, {"status": "affected", "version": "d57a3a151660902091491ac2633134e1be92557f", "lessThan": "224298450be5c04d2a6ea1c2a94669d7ebf65d00", "versionType": "git"}, {"status": "affected", "version": "d57a3a151660902091491ac2633134e1be92557f", "lessThan": "333b6d5bb9f87827ac2639c737bf9613dbae7253", "versionType": "git"}], "programFiles": ["net/rxrpc/input.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rxrpc/input.c"], "defaultStatus": "affected"}]}], "published": "2026-06-25T09:16:32.480", "references": [{"url": "https://git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Undergoing Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix the ACK parser to extract the SACK table for parsing\n\nFix modification of the received skbuff in rxrpc_input_soft_acks() and a\npotential incorrect access of the buffer in a fragmented UDP packet (the\npacket would probably have to be deliberately pre-generated as fragmented)\nwhen AF_RXRPC tries to extract the contents of the SACK table by copying\nout the contents of the SACK table into a buffer before attempting to parse\n\nAF_RXRPC assumes that it can just call skb_condense() and then validly\naccess the SACK table from skb->data and that it will be a flat buffer -\nbut skb_condense() can silently fail to do anything under some\ncircumstances.\n\nNote that whilst rxrpc_input_soft_acks() should be able to parse extended\nACKs, the rest of AF_RXRPC doesn't currently support that.\n\nFurther, there's then no need to call skb_condense() in rxrpc_input_ack(),\nso don't."}], "lastModified": "2026-07-04T12:16:59.310", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}