Executive brief
A vulnerability was identified in the Linux kernel's networking component responsible for handling RXRPC protocol traffic. Under specific conditions involving fragmented network packets, the system could incorrectly access memory while processing acknowledgement messages. This could potentially lead to system instability or crashes, affecting the reliability of network services using this protocol.
Technical details
A vulnerability exists in the AF_RXRPC implementation within the Linux kernel due to improper handling of socket buffers (sk_buff) during ACK parsing. The function rxrpc_input_soft_acks() incorrectly assumed that calling skb_condense() would always result in a flat, contiguous buffer for accessing the SACK table. However, skb_condense() can silently fail, leading to out-of-bounds or incorrect memory access when processing fragmented UDP packets. An attacker could potentially exploit this by sending specially crafted fragmented UDP packets to trigger an invalid memory access. The fix involves using skb_copy_bits() to safely extract the SACK table into a local buffer before parsing.
Affected products
- Linux Linux Kernel 6.2 to 7.1
Timeline
- 2026-06-04: other: Fix authored
- 2026-06-25: disclosed: CVE published