External risk intelligence

Linux Kernel rxrpc ACK Parser Buffer Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-53151

The vulnerability exists in the Linux kernel's AF_RXRPC protocol. While this protocol facilitates networked communication, it is typically restricted to specific distributed file systems or internal cluster traffic rather than general public-facing services. Exploitation requires specialized network configurations, making it less likely to be exposed as a common internet-facing edge service.

Linux Kernel

6.2 to before 6.6.1446.7 to before 6.12.956.13 to before 6.18.366.19 to before 7.0.137.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's networking component could potentially allow for unauthorized access and modification of data if specific, deliberately crafted network packets are sent. The issue has been resolved in the kernel's code.

Kernel network code had a parsing error.
It affects how fragmented network packets are handled.
Confirm if this specific kernel function is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted, fragmented UDP packets over the network. The Linux kernel's AF_RXRPC protocol, when processing these packets, might incorrectly parse a received SACK table due to a flawed ACK parser and an unreliable buffer condensation function. If successful, this could allow an attacker to read or write sensitive kernel memory, leading to a complete system compromise.

Requires network access and fragmented UDP packets.
Triggered by incorrect SACK table parsing.
Risk of critical data compromise and system takeover.

Live Threat

Current exploitation, exposure, and threat context

A flaw in the Linux kernel's ACK parser could allow an attacker to gain control of system data when processing specially crafted, fragmented UDP packets. This could occur when the AF_RXRPC protocol attempts to parse a SACK table, assuming it is a flat buffer when it may not be.

System data integrity and availability.
Specially crafted, fragmented UDP packets.
Potential for data corruption or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's rxrpc protocol affects networked communication, likely within specific distributed file systems or cluster environments. System owners and infrastructure teams should lead the effort to identify all instances of the affected kernel component, confirm its network reachability and business criticality, and then assign an accountable owner for remediation planning.

Kernel and Infrastructure teams own remediation.
Verify AF_RXRPC usage and network exposure.
Plan risk-based remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel AF_RXRPC protocol?

The AF_RXRPC protocol is a component of the Linux kernel used to manage networked communication. It is primarily utilized by specialized distributed file systems and cluster computing environments to handle data exchange between systems. Because it is not a general-purpose web service, it is typically limited to internal infrastructure rather than public-facing applications.

What is the weakness in CVE-2026-53151?

This vulnerability is a memory handling flaw within the ACK parser of the AF_RXRPC component. The parser incorrectly assumes that certain incoming network data packets, specifically SACK tables, will always arrive as flat, contiguous buffers. When the kernel attempts to process these packets—especially if they are fragmented—it can lead to improper memory access, potentially allowing unauthorized data reads or writes.

How does an attacker trigger this vulnerability?

An attacker must send specifically crafted, fragmented UDP packets to a system using the affected AF_RXRPC protocol. The bug occurs when the system fails to properly condense the received data into the expected format before parsing. Standard, non-fragmented traffic or systems that do not have this specific protocol enabled are not subject to this particular trigger path.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that while this is a critical issue, the risk is often limited because AF_RXRPC is typically restricted to internal cluster or file system traffic. It is rarely exposed as a common internet-facing service. You should evaluate whether your network architecture specifically permits external traffic to reach these internal-use protocol listeners.

What are the first steps to address this CVE?

You should begin by identifying which systems in your environment have the AF_RXRPC protocol active. Once identified, confirm if these systems are accessible over the network. Coordinate with your infrastructure and kernel maintenance teams to verify the status of the affected kernel components and prioritize remediation planning based on whether these systems facilitate critical business communication.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.