Resource exhaustion in Linux kernel - CVE-2026-53183

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU135608

Resource exhaustion in Linux kernel - CVE-2026-53183

Published: June 26, 2026


Vulnerability identifier: #VU135608
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53183
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in MPTCP DSS option handling in net/mptcp/options.c when processing incoming MPTCP traffic with out-of-order data in the MPTCP sequence space or data landing in the backlog. A remote attacker can send traffic that triggers artificial inflation of the MPTCP receive window to cause a denial of service.

The issue can allow incoming traffic to exceed the receiver rcvbuf size even when the sender is not misbehaving.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

How to mitigate CVE-2026-53183

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13

External References

Related Security Bulletins