Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T00:00:00 kernel: rxrpc: Fix the ACK parser to extract the SACK table for parsing 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

A flaw was found in the Linux kernel's AF_RXRPC subsystem. This vulnerability involves incorrect handling of fragmented UDP packets when parsing the SACK (Selective Acknowledgment) table. An attacker could potentially craft a fragmented UDP packet to trigger an incorrect buffer access within the kernel, which may lead to system instability or other undefined behavior.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53151 https://nvd.nist.gov/vuln/detail/CVE-2026-53151 https://lore.kernel.org/linux-cve-announce/2026062547-CVE-2026-53151-4924@gregkh/T