Threats Tagged 'cve-2026-53151'

A critical vulnerability in the Linux kernel's rxrpc protocol implementation involves improper handling of the ACK parser and the SACK table extraction. The flaw relates to modification of the received socket buffer and potential incorrect access of fragmented UDP packets when parsing the SACK table. The issue arises because the function skb_condense() may fail silently, leading to invalid assumptions about buffer layout. This vulnerability has been resolved by fixing the ACK parser and removing unnecessary calls to skb_condense().

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.