CVE-2026-53151: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53151 Overview

CVE-2026-53151 is a Linux kernel vulnerability in the rxrpc (AF_RXRPC) subsystem. The flaw resides in the ACK parser, specifically in how rxrpc_input_soft_acks() extracts the Selective Acknowledgment (SACK) table from incoming packets. The function assumed that calling skb_condense() would linearize the socket buffer into a flat region accessible from skb->data, but skb_condense() can silently fail under certain conditions. When the underlying UDP packet is fragmented, this assumption leads to incorrect buffer access and unintended modification of the received skbuff.

Critical Impact
A specially crafted, deliberately fragmented UDP packet directed at an AF_RXRPC listener can trigger incorrect buffer access during SACK table parsing in the Linux kernel.

Affected Products

Linux kernel — AF_RXRPC (net/rxrpc) subsystem
Distributions shipping affected upstream kernel versions prior to the fix commits
Systems with CONFIG_AF_RXRPC enabled and exposed to untrusted RxRPC/UDP traffic

Discovery Timeline

2026-06-25 - CVE-2026-53151 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53151

Vulnerability Analysis

The defect lives in the RxRPC ACK packet processing path. RxRPC ACK packets carry a SACK table describing which packets in a window have been received. To parse this table, rxrpc_input_soft_acks() needed contiguous access to the relevant bytes in the socket buffer. The original implementation called skb_condense() and then read directly from skb->data, treating the buffer as a flat, linear region.

This assumption is unsafe. skb_condense() is best-effort and can leave a fragmented skbuff in a non-linear state. When the inbound UDP datagram has been fragmented at the IP layer and reassembled into a multi-fragment skb, reads from skb->data past the linear header region access memory that does not belong to the SACK table.

The upstream fix changes the parser to copy the SACK table contents into a local buffer before parsing, rather than relying on in-place access to the skbuff. The redundant skb_condense() call in rxrpc_input_ack() is also removed. The maintainer note adds that while rxrpc_input_soft_acks() is being updated to handle extended ACKs structurally, the rest of AF_RXRPC does not currently support them.

Root Cause

The root cause is an unsafe assumption about socket buffer linearity. skb_condense() does not guarantee that an skb becomes linear, yet the caller treated skb->data as containing the full SACK table. Combined with the fact that the parser also mutated the received skbuff during extraction, the function produced incorrect behavior on fragmented packets [CWE-125: Out-of-bounds Read class].

Attack Vector

Exploitation requires delivering a deliberately pre-generated fragmented UDP packet to an endpoint running AF_RXRPC. Because IP fragmentation normally does not occur for small ACK-sized payloads, an attacker would need to craft the fragmentation pattern explicitly. Successful triggering causes the kernel to parse SACK data from incorrect buffer offsets and to modify the received skb, with results dependent on adjacent memory contents.

No verified public proof-of-concept code is available. Refer to the upstream commits (224298450be5, 333b6d5bb9f8, and 566c4c1244de) for the corrective patches.

Detection Methods for CVE-2026-53151

Indicators of Compromise

Unexpected kernel warnings or oopses originating from net/rxrpc/input.c functions such as rxrpc_input_soft_acks or rxrpc_input_ack.
Inbound UDP traffic to RxRPC service ports that arrives as IP fragments without a legitimate operational reason.
Anomalous RxRPC connection state transitions or retransmission storms following malformed ACK delivery.

Detection Strategies

Audit running kernel versions against the upstream fix commits to identify hosts that have not received the patch.
Enable kernel sanitizers such as KASAN in test environments to catch out-of-bounds reads during RxRPC ACK processing.
Inspect dmesg and journald logs for repeated soft-lockups or memory access warnings tied to the rxrpc module.

Monitoring Recommendations

Monitor inbound IP fragmentation rates on hosts exposing AF_RXRPC and alert on sustained anomalies.
Track loaded kernel modules and version strings across the fleet to ensure consistent patch coverage.
Forward kernel logs to a centralized analytics platform and create rules for rxrpc-prefixed warning messages.

How to Mitigate CVE-2026-53151

Immediate Actions Required

Apply the upstream kernel patches from the stable tree commits 224298450be5, 333b6d5bb9f8, and 566c4c1244de.
Update to a distribution kernel package that includes the rxrpc ACK parser fix once available from your vendor.
Restrict exposure of AF_RXRPC services to trusted networks until patching is complete.

Patch Information

The fix is published in the Linux stable tree across multiple branches. The corrective commits change rxrpc_input_soft_acks() to copy the SACK table into a local buffer before parsing and remove the redundant skb_condense() call from rxrpc_input_ack(). Patch references:

Workarounds

Disable the rxrpc kernel module on systems that do not require AF_RXRPC functionality, for example AFS clients or servers.
Block or rate-limit inbound IP-fragmented UDP traffic destined for RxRPC service endpoints at the perimeter and host firewall.
Constrain access to AF_RXRPC ports to known peer addresses using netfilter rules until the patched kernel is deployed.

bash

# Configuration example: unload rxrpc where unused and block fragmented inbound UDP
sudo modprobe -r rxrpc
echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf

# Drop inbound IP-fragmented UDP at the host firewall (adjust interface as needed)
sudo nft add rule inet filter input meta l4proto udp ip frag-off & 0x1fff != 0 drop