CVE-2026-53151 — rxrpc: Fix the ACK parser to extract the SACK table for parsing

Back Back to CVE browser

CRITICAL

rxrpc: Fix the ACK parser to extract the SACK table for parsing

Published Jun 25, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.67%

Description

Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse

AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.

Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.

Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.2
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.2
- Version
  6.12.95
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.36
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.6.144
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  7.0.13
  Status
  unaffected
  Constraints
  <=7.0.*
- Version
  7.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
6.2	affected	-
0	unaffected	<6.2
6.12.95	unaffected	<=6.12.*
6.18.36	unaffected	<=6.18.*
6.6.144	unaffected	<=6.6.*
7.0.13	unaffected	<=7.0.*
7.1	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

0.67% 0.00671

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00671

Score over time

Jun–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.67% (0.00671)	50.31th	v5 (v2026.06.15)
Jun 25, 2026	0.17% (0.00173)	6.98th	v5 (v2026.06.15)

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (10)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-53151		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492837		Issue Tracking
https://git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00		Patch
https://git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253		Patch
https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4		Patch
https://git.kernel.org/stable/c/5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1		Patch
https://git.kernel.org/stable/c/775c5e89272a2615b72bb84f611ba66fa3b7493e		Patch
https://lore.kernel.org/linux-cve-announce/2026062547-CVE-2026-53151-4924@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53151
https://www.cve.org/CVERecord?id=CVE-2026-53151