Skip to main content

Linux Kernel CVE-2026-53151

| EUVDEUVD-2026-39242 CRITICAL
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fp35-jcpc-9wwg
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.8 MEDIUM

Remote unauthenticated (AV:N/PR:N), but needs a deliberately fragmented packet and active AF_RXRPC so AC:H; impact is an out-of-bounds read (C:L) with possible processing crash (A:L), not code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:16 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix the ACK parser to extract the SACK table for parsing

Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse

AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances.

Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that.

Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

AnalysisAI

Out-of-bounds buffer access in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem allows a remote attacker who can send crafted RxRPC-over-UDP traffic to trigger improper reads of the SACK table when an incoming ACK packet is deliberately fragmented. AF_RXRPC wrongly assumes skb_condense() always linearizes the packet before parsing soft-ACKs in rxrpc_input_soft_acks(), but skb_condense() can silently no-op, leading to access of a non-flat buffer and in-place modification of the received skbuff. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and this is not in CISA KEV.

Technical ContextAI

The flaw is in net/rxrpc, the kernel implementation of the RxRPC remote procedure call transport used primarily by the kafs/AFS distributed filesystem client. When processing an incoming ACK frame, rxrpc_input_soft_acks() copies the SACK (selective acknowledgement) table out of the socket buffer, but the code relied on skb_condense() to guarantee a single flat/linear buffer accessible directly via skb->data. skb_condense() is only a best-effort compaction and can leave the data paged or fragmented, so the parser could read past the linear region of a fragmented UDP datagram and could also mutate the received skbuff. The root cause is an unvalidated assumption about buffer linearity (an out-of-bounds/improper-buffer-access class of defect, akin to CWE-125); no CWE was assigned in the input. The vendor tag 'Information Disclosure' aligns with an out-of-bounds read rather than memory corruption.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.36, 7.0.13, or 7.1 or later on the corresponding branch (commits 566c4c1244de50fbff1f89ff93c9d7b0fc256db4, 224298450be5c04d2a6ea1c2a94669d7ebf65d00, 333b6d5bb9f87827ac2639c737bf9613dbae7253 at git.kernel.org/stable). Apply your distribution's backported kernel update where these are not yet packaged. As a compensating control on systems that do not use AFS, blacklist/unload the rxrpc kernel module (e.g., prevent autoload of rxrpc / AF_RXRPC) to remove the vulnerable code path entirely - the trade-off is that any kafs/AFS client functionality will stop working. Where RxRPC must remain enabled, restrict inbound UDP to the RxRPC service from untrusted networks at the host/network firewall, accepting that this does not protect against trusted-network or on-path senders. Reference: https://git.kernel.org/stable/c/566c4c1244de50fbff1f89ff93c9d7b0fc256db4.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53151 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy