CVE-2026-53151 rxrpc: Fix the ACK parser to extract the SACK table for parsing
A flaw in the Linux kernel's AF_RXRPC module allows attackers to cause memory corruption or denial of service via crafted fragmented UDP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53151?
CVE-2026-53151 is a critical memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix the ACK parser to extract the SACK table for parsing
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse
AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.
Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.
Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.
Weakness: CWE-125
Which versions are affected by CVE-2026-53151?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53151?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53151 being exploited?
There is no known exploitation of CVE-2026-53151 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90306, BELL-CVE-2026-53151, DEBIAN-CVE-2026-53151, GHSA-fp35-jcpc-9wwg, ROOT-OS-DEBIAN-13-CVE-2026-53151, ROOT-OS-UBUNTU-2404-CVE-2026-53151 and 1 more.