CVE-2026-53151: Linux kernel rxrpc ACK parser SACK table flaw
CVE-2026-53151 is a flaw in the Linux kernel AF_RXRPC ACK parser, where the SACK table was read from a received buffer that may not be flat or safely accessible. The upstream fix copies the SACK table into a separate buffer before parsing. The record shows a CNA-assigned CVSS 3.1 base score of 9.8, is not listed in CISA KEV, and reports no confirmed exploitation in the sources consulted.
Overview
CVE-2026-53151 is recorded against the Linux kernel AF_RXRPC implementation. According to the record, the ACK parser in rxrpc_input_soft_acks() could modify a received socket buffer and could access the buffer incorrectly when a UDP packet is fragmented. The upstream fix copies the SACK table into a separate buffer before parsing, instead of relying on skb_condense() to produce a flat buffer.
Impact
- The record describes modification of a received buffer and a potentially incorrect buffer access, which concerns kernel memory handling.
- The CNA-provided CVSS 3.1 base score is 9.8, rated critical, with high impact stated for confidentiality, integrity and availability.
- The record does not confirm a specific outcome such as code execution or data disclosure. The practical consequences remain unknown from the available data.
Affected products and versions
The record lists the Linux Linux Kernel product with these ranges:
- From 6.2 up to, but not including, 6.6.144
- From 6.7 up to, but not including, 6.12.95
- From 6.13 up to, but not including, 6.18.36
- From 6.19 up to, but not including, 7.0.13
- 7.1-rc1 to 7.1-rc7
The record does not state a fixed release for the 7.1 series. Review the linked stable kernel commits and your distribution packages.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record. No confirmed active exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Apply stable kernel updates that include the upstream fix commits listed in the references, or the kernel updates published by your distribution.
- Prioritize hosts where AF_RXRPC is loaded or reachable, given the critical score in the record.
- If the rxrpc feature is not needed, restricting or not loading the module is a general defensive measure. This is inference and not stated in the record.
Detection guidance
- Inventory Linux systems and compare running kernel versions with the affected ranges above.
- Check vendor security notices, because stable backports may carry the fix under different version numbers.
- Investigate unexpected kernel faults or memory errors on systems that handle rxrpc traffic. This is a general indicator and does not confirm exploitation.
Limitations of the available information
The record provides no CWE, no EPSS score, no SSVC data and no vendor advisory text. The title is empty in the source record. The description states that AF_RXRPC does not currently support extended ACKs, which narrows the scope. Exploitability and the worst-case impact are not established by the sources consulted.
Frequently asked questions
Is CVE-2026-53151 known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
Which Linux kernel versions are listed as affected?
The record lists ranges from 6.2 up to 6.6.144, from 6.7 up to 6.12.95, from 6.13 up to 6.18.36, from 6.19 up to 7.0.13, and 7.1-rc1 to 7.1-rc7.
What does the fix change?
It copies the SACK table into a separate buffer before parsing, instead of relying on skb_condense() to provide a flat buffer.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.