CVE-2026-53151

A flaw was found in the Linux kernel's AF_RXRPC subsystem. This vulnerability involves incorrect handling of fragmented UDP packets when parsing the SACK (Selective Acknowledgment) table. An attacker could potentially craft a fragmented UDP packet to trigger an incorrect buffer access within the kernel, which may lead to system instability or other undefined behavior.

The vulnerability in the Linux kernel AF_RXRPC subsystem occurs when rxrpc_input_soft_acks() parses a SACK table directly from skb->data, assuming a contiguous buffer. However, fragmented UDP packets may use non-linear sk_buffs, and skb_condense() may fail to linearize them, potentially causing out-of-bounds memory access, incorrect ACK processing, or a kernel crash.

Exploitation requires an active AF_RXRPC connection, a valid ACK context, and a specially crafted fragmented UDP packet passing protocol validation. Simply enabling AF_RXRPC does not make a system remotely exploitable; a malicious RxRPC peer or an attacker capable of injecting suitable traffic is a more realistic scenario.

For the CVSS, PR:N reflects that no target privileges are inherently required, while AC:H accounts for fragmentation, connection-state requirements, and ACK validation.

The likely impact is remote denial of service through invalid kernel memory access. Additional confidentiality or integrity impact remains uncertain, with no demonstrated reliable information disclosure, controlled out-of-bounds write, or privilege escalation.

Given the restricted attack surface, complex triggering conditions, and unproven exploitation beyond denial of service, MODERATE severity is defensible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the rxrpc kernel module from loading:

1. Create a configuration file to disable autoloading:

echo "install rxrpc /bin/true" > /etc/modprobe.d/disable-rxrpc.conf

2. If the module is already loaded, unload it or restart the system:

modprobe -r rxrpc

Caveats: Modifying kernel module configurations, unloading active modules, or restarting the system may interrupt running services. Disabling this module prevents functionality reliant on the AF_RXRPC protocol, including the in-kernel AFS filesystem (kAFS).