[SRU][Q][PATCH 0/1] CVE-2026-53151

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53151

[ Impact ]

AF_RXRPC assumes it can call skb_condense() and then validly access the SACK
table as a flat buffer directly from skb->data, but skb_condense() can silently
fail to do anything under some circumstances. This leads to modification of the
received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of
the buffer in a fragmented UDP packet when AF_RXRPC extracts the contents of
the SACK table. A deliberately pre-generated fragmented packet could trigger
the incorrect buffer access.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix could affect the rxrpc networking subsystem,
potentially causing incorrect ACK processing or misparsing of SACK tables in
AF_RXRPC connections used by AFS clients.