PT-2026-52247 · Linux · Linux

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-53151

Mitre

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix the ACK parser to extract the SACK table for parsing

Fix modification of the received skbuff in rxrpc input soft acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse

AF RXRPC assumes that it can just call skb condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb condense() can silently fail to do anything under some circumstances.

Note that whilst rxrpc input soft acks() should be able to parse extended ACKs, the rest of AF RXRPC doesn't currently support that.

Further, there's then no need to call skb condense() in rxrpc input ack(), so don't.

Identificadores relacionados

CVE-2026-53151

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53151 · Nota de Segurança
• https://git.kernel.org/stable/c/333b6d5bb9f87827ac2639c737bf9613dbae7253 · Nota
• https://git.kernel.org/stable/c/224298450be5c04d2a6ea1c2a94669d7ebf65d00 · Nota