CVE-2026-53151

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix the ACK parser to extract the SACK table for parsing

Fix modification of the received skbuff in rxrpc_input_soft_acks() and a

potential incorrect access of the buffer in a fragmented UDP packet (the

packet would probably have to be deliberately pre-generated as fragmented)

when AF_RXRPC tries to extract the contents of the SACK table by copying

out the contents of the SACK table into a buffer before attempting to parse

AF_RXRPC assumes that it can just call skb_condense() and then validly

access the SACK table from skb->data and that it will be a flat buffer -

but skb_condense() can silently fail to do anything under some

circumstances.

Note that whilst rxrpc_input_soft_acks() should be able to parse extended

ACKs, the rest of AF_RXRPC doesn't currently support that.

Further, there's then no need to call skb_condense() in rxrpc_input_ack(),

so don't.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References