CVE-2026-53183— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1498 · Network Denial of ServiceAffected Version Matrix 14
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | f3589be0c420a3137e5902d15705ced6a36f3f43< bf364b0f10b27679140699821f88af7f01e2a6e3 | affected |
f3589be0c420a3137e5902d15705ced6a36f3f43< b1fd13074f22105deec45aa02283e322733e0c2d | affected | ||
f3589be0c420a3137e5902d15705ced6a36f3f43< aa3861f40ac32706d9e97bfac76984613e278788 | affected | ||
f3589be0c420a3137e5902d15705ced6a36f3f43< 653245266913f03fcf21cbca68eed5c197a33e52 | affected | ||
f3589be0c420a3137e5902d15705ced6a36f3f43< c297a4e65c50a2b807d9309b22615080faffa8f3 | affected | ||
f3589be0c420a3137e5902d15705ced6a36f3f43< da23be77e1292cd611e736c3aa17da633d7ddce7 | affected | ||
5.19 | affected | ||
< 5.19 | unaffected | ||
| … +6 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-53183の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
mptcp: allow subflow rcv wnd to shrink
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge does not move backward. That in turn causes artificial inflating of the MPTCP rcv window when the incoming data is acked at the TCP level and is OoO in the MPTCP sequence space (or lands in the backlog). As a consequence, the incoming traffic can exceed the receiver rcvbuf size even when the sender is not misbehaving. Prevent such scenario forcibly allowing the TCP subflow to shrink the TCP-level rcv wnd regardless of the current netns setting.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 5.19版本存在安全漏洞，该漏洞源于mptcp连接中TCP窗口处理问题，可能导致当传入数据在TCP层面被确认且处于MPTCP序列空间乱序或落入backlog时，TCP栈独立确保的右边界不向后移动会人为膨胀MPTCP接收窗口，从而造成传入流量在发送方正常的情况下超过接收方rcvbuf大小。攻击者可利用该漏洞造成拒绝服务。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-53183の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-53183のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-53183 补丁与修复 (6)
Same Patch Batch · Linux · 2026-06-25 · 147 CVEs total
| CVE-2026-53175 | 9.8 CRITICAL | inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush |
| CVE-2026-53176 | 9.8 CRITICAL | IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN |
| CVE-2026-53221 | 9.8 CRITICAL | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() |
| CVE-2026-53228 | 9.8 CRITICAL | ipv6: sit: reload inner IPv6 header after GSO offloads |
| CVE-2026-53216 | 9.8 CRITICAL | net: mvpp2: limit XDP frame size to the RX buffer |
| CVE-2026-53151 | 9.8 CRITICAL | rxrpc: Fix the ACK parser to extract the SACK table for parsing |
| CVE-2026-53260 | 9.8 CRITICAL | tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). |
| CVE-2026-53215 | 9.8 CRITICAL | net: mvpp2: refill RX buffers before XDP or skb use |
| CVE-2026-53247 | 9.8 CRITICAL | net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown |
| CVE-2026-53246 | 9.8 CRITICAL | sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing |
| CVE-2026-53131 | 9.4 CRITICAL | netfilter: require Ethernet MAC header before using eth_hdr() |
| CVE-2026-53225 | 9.1 CRITICAL | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() |
| CVE-2026-53186 | 9.1 CRITICAL | RDMA/srp: bound SRP_RSP sense copy by the received length |
| CVE-2026-53224 | 9.1 CRITICAL | sctp: validate embedded INIT chunk and address list lengths in cookie |
| CVE-2026-53200 | 8.8 HIGH | KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX |
| CVE-2026-53277 | 8.8 HIGH | KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation |
| CVE-2026-53232 | 8.8 HIGH | net: phy: clean the sfp upstream if phy probing fails |
| CVE-2026-53248 | 8.8 HIGH | net: airoha: Fix use-after-free in metadata dst teardown |
| CVE-2026-53198 | 8.8 HIGH | ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL |
| CVE-2026-53240 | 8.8 HIGH | xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload |
Showing 20 of 147 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
同じベンダー: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
V. CVE-2026-53183へのコメント
まだコメントはありません