CVE-2026-53151
Description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.
Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.
Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.
Affected products
23cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.2,<6.6.144
- cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*
- (no CPE)
- osv-coords14 versionspkg:apk/chainguard/linux-aws-6.12pkg:apk/chainguard/linux-aws-6.18pkg:apk/chainguard/linux-azure-6.12pkg:apk/chainguard/linux-azure-6.18pkg:apk/chainguard/linux-gcp-6.12pkg:apk/chainguard/linux-gcp-6.18pkg:apk/chainguard/linux-gcp-6.18-bootc-boot-installedpkg:apk/chainguard/linux-qemu-6.12pkg:apk/chainguard/linux-qemu-6.18pkg:apk/chainguard/linux-qemu-6.18-bootc-boot-installedpkg:apk/chainguard/linux-qemu-melangepkg:apk/chainguard/linux-vmware-6.12pkg:apk/chainguard/linux-vmware-6.18pkg:linux/kernel
< 6.12.96-r0+ 13 more
- (no CPE)range: < 6.12.96-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.96-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.96-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.96-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.36-r0
- (no CPE)range: < 6.12.96-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: >= 6.2.0, < 6.6.144
Patches
Vulnerability mechanics
References
5- git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00nvdPatch
- git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253nvdPatch
- git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4nvdPatch
- git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1nvdPatch
- git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493envdPatch
News mentions
0No linked articles in our index yet.