CyberSecBulletin
CVE-2026-53151NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-53151 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1, 775c5e89272a2615b72bb84f611ba66fa3b7493e, 566c4c1244de50fbff1f89ff93c9d7b0fc256db4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.67% chance of exploitation within 30 days, higher than 53% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1 or 775c5e89272a2615b72bb84f611ba66fa3b7493e or 566c4c1244de50fbff1f89ff93c9d7b0fc256db4 or 224298450be5c04d2a6ea1c2a94669d7ebf65d00, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.144 or 6.12.95 or 6.18.36 or 7.0.13, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd57a3a151660902091491ac2633134e1be92557f up to, but not including, 5d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1; d57a3a151660902091491ac2633134e1be92557f up to, but not including, 775c5e89272a2615b72bb84f611ba66fa3b7493e; d57a3a151660902091491ac2633134e1be92557f up to, but not including, 566c4c1244de50fbff1f89ff93c9d7b0fc256db4; d57a3a151660902091491ac2633134e1be92557f up to, but not including, 224298450be5c04d2a6ea1c2a94669d7ebf65d00; d57a3a151660902091491ac2633134e1be92557f up to, but not including, 333b6d5bb9f87827ac2639c737bf9613dbae7253; 6.25d1ae4e17a3ecd8561cdb4f4f70152f41039c4e1, 775c5e89272a2615b72bb84f611ba66fa3b7493e, 566c4c1244de50fbff1f89ff93c9d7b0fc256db4, 224298450be5c04d2a6ea1c2a94669d7ebf65d00, 333b6d5bb9f87827ac2639c737bf9613dbae7253
LinuxLinux Kernel6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.16.6.144, 6.12.95, 6.18.36, 7.0.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.