CVE-2026-53151: rxrpc: Fix the ACK parser to extract the SACK table for parsing

Synopsis

An out-of-bounds memory access vulnerability exists in the Linux kernel's AF_RXRPC subsystem, specifically in the ACK packet parser (rxrpc_input_soft_acks). The flaw is reachable over the network without any authentication or user interaction, triggered by a specially crafted fragmented UDP packet that causes the kernel to read from an invalid memory location when processing the SACK table. Successful exploitation gives an attacker full read, write, and crash capabilities against the affected host. A patched-image rebuild at fix version 6.18.36 (and the corresponding commit SHAs) is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reached by sending a specially crafted fragmented UDP packet over the network to any host exposing an AF_RXRPC socket, so the attacker must be able to reach the service across the network.

• AuthenticationNot required

  No credentials or account of any kind are needed; the malformed packet can be sent by an unauthenticated remote attacker.

• Victim interactionNot required

  No user action is required; the kernel processes incoming packets automatically without any interaction from a logged-in user.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental preconditions beyond network access.

Blast Radius

• An attacker can read arbitrary kernel memory, exposing secrets such as cryptographic keys, session tokens, and other in-memory data from any process on the host.
• An attacker can write to arbitrary kernel memory, modifying kernel data structures, escalating privileges, or planting malicious code in kernel space.
• An attacker can crash the kernel entirely, taking down all workloads running on the affected node and causing a full denial of service.
• Any container running on the same host shares the underlying kernel, so a successful exploit against the host kernel breaks the isolation boundary for all co-located containers regardless of their individual configurations.