CVE-2026-53362
Linux Kernel Unspecified Vulnerability
Description
CVE-2026-53362 is a high-severity out-of-bounds write vulnerability in the Linux kernel's IPv6 networking stack, specifically in __ip6_append_data(). When the paged-allocation branch is taken, alloclen and pagedlen fail to account for the fraggap bytes carried over from the previous socket buffer, so the linear area is undersized by exactly that amount while pagedlen is overstated by the same, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger this heap corruption through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, making it a practical local privilege escalation primitive. The Linux kernel vulnerability affects a wide range of stable branches and carries a CVSS score of 7.8; CISA has added CVE-2026-53362 to the Known Exploited Vulnerabilities (KEV) catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 6.0, < 6.1.177; >= 6.2, < 6.6.144; >= 6.7, < 6.12.95; >= 6.13, < 6.18.38; >= 6.19, < 7.1.3 |
References
- https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962(Patch)
- https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d(Patch)
- https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a(Patch)
- https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769(Patch)
- https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5(Patch)
- https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e(Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
An out-of-bounds write occurs when software writes data outside the intended boundaries of a buffer, whether through a buffer overflow, a bad index, pointer arithmetic errors or integer overflows affecting size calculations. In CVE-2026-53362 the size calculation itself is wrong: datalen already includes fraggap, but the paged branch computes alloclen = fragheaderlen + transhdrlen without it, so the subsequent copy of the carried-over fragment bytes writes past the end of the allocation.
Learn more: CWE-787 — Out-of-bounds Write
CWE-122: Heap-based Buffer Overflow
A heap-based buffer overflow is an overflow in dynamically allocated memory, corrupting adjacent heap objects and metadata. Here the overflowing buffer is a kernel socket buffer, and the data spills directly into the trailing skb_shared_info structure — a control structure the kernel itself trusts, which is what makes this corruption particularly attractive to exploit.
Learn more: CWE-122 — Heap-based Buffer Overflow
Impact Analysis
CVE-2026-53362 requires local access and low privileges, but the emphasis belongs on how low: the kernel commit message states explicitly that an unprivileged user can trigger the flaw through an ordinary UDPv6 socket, so no capabilities, no root and no special configuration are needed — only the ability to run code on the machine. Attack complexity is low and no user interaction is required, and the impact is high for confidentiality, integrity and availability, because corruption of skb_shared_info in kernel heap memory is a well-understood route to arbitrary kernel write and hence to full root compromise, or at minimum to a kernel panic. On shared systems — container hosts, terminal servers, multi-tenant infrastructure, CI runners — this is exactly the primitive an attacker needs to break out of a low-privileged context. The CVSS 3.1 base score is 7.8 (High), and the EPSS score of roughly 0.5% (42nd percentile) is expected to be low for a local kernel flaw, since EPSS models internet-facing scanning; CISA's KEV listing confirms real-world exploitation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-53362 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 30 August 2026 that has already passed, so this kernel flaw is in use in real intrusions. No packaged exploit is listed among the references, but the six public stable-tree patch commits are themselves substantial guidance: the commit message names the exact trigger — a UDPv6 socket using MSG_MORE with MSG_SPLICE_PAGES — identifies the faulty arithmetic line by line, and explains why an unprivileged user can reach it. For an experienced kernel exploit developer that is effectively a head start. The EPSS score of about 0.5% (42nd percentile) should not reassure anyone, since EPSS reflects internet-facing scanning activity that is irrelevant to a local privilege escalation. Given that Linux kernel LPEs are staple components of post-exploitation toolkits, treat unpatched multi-user systems as exposed.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with your distribution's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the affected systems if mitigations are unavailable. The KEV due date of 30 August 2026 has passed.
- Update the kernel to a fixed stable release. Affected ranges are 6.0 up to 6.1.177, 6.2 up to 6.6.144, 6.7 up to 6.12.95, 6.13 up to 6.18.38 and 6.19 up to 7.1.3; install your distribution's kernel update containing the upstream fix and reboot, since kernel patches do not take effect until the new image is running.
- Prioritise multi-tenant and container hosts. Any system where untrusted or semi-trusted code runs as a local user — Kubernetes nodes, shared build infrastructure, VDI and terminal servers, hosting platforms — is the highest-value target for an unprivileged-to-root kernel bug and should be rebooted into the patched kernel first.
- Reduce reachability of the vulnerable path where patching must wait. The trigger requires a UDPv6 socket using
MSG_MOREwithMSG_SPLICE_PAGES; where IPv6 is genuinely unused, disabling it removes the path entirely, and restricting unprivileged user namespaces and applying seccomp profiles that limit socket syscalls reduces the surface for untrusted workloads. Treat these as stopgaps, not fixes. - Monitor for exploitation and harden long term. Alert on unexplained kernel oopses, panics and
skb-related warnings, which typically precede a successful heap-corruption exploit, and use EDR telemetry to flag processes gaining root from unprivileged parents; then maintain a short kernel patch cadence with live patching or scheduled reboot windows, since memory-safety defects in the networking stack are found regularly and are almost always local-privilege-escalation grade.
Technical Details
CVE-2026-53362 is an out-of-bounds write (CWE-787) manifesting as a heap-based buffer overflow (CWE-122) in __ip6_append_data() in the Linux kernel's IPv6 stack. When the paged-allocation branch is taken — under MSG_MORE, NETIF_F_SG or a large fraglen — the code computes alloclen = fragheaderlen + transhdrlen and pagedlen = datalen - transhdrlen. Since datalen = length + fraggap, a non-zero fraggap means this is not the first skb and transhdrlen is zero, yet the fraggap bytes carried over from the previous skb are copied just past the fragment headers into the new skb's linear area. The linear area is thus undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes beyond skb->end into the trailing skb_shared_info. The faulty accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"); before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES") the resulting negative copy value produced -EINVAL, and that later commit allowed MSG_SPLICE_PAGES to proceed, making the corruption triggerable. The fix brings the paged branch in line with the non-paged branch by adding fraggap to alloclen and subtracting it from pagedlen. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H records a local, low-complexity, low-privilege attack with no user interaction and complete impact on confidentiality, integrity and availability.
Frequently Asked Questions
Is CVE-2026-53362 being actively exploited?
Yes. CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog with a remediation due date of 30 August 2026, confirming exploitation in the wild. The low EPSS score is normal for a local kernel vulnerability and does not indicate low risk, because such flaws are used after an attacker already has code execution on the host.
What products are affected by CVE-2026-53362?
The Linux kernel is affected in versions 6.0 up to 6.1.177, 6.2 up to 6.6.144, 6.7 up to 6.12.95, 6.13 up to 6.18.38 and 6.19 up to 7.1.3. The vulnerable code is in the IPv6 stack's __ip6_append_data() function, reachable through a UDPv6 socket using MSG_MORE with MSG_SPLICE_PAGES.
How do I fix CVE-2026-53362?
Install your distribution's kernel update containing the upstream fix — which adds fraggap to alloclen and subtracts it from pagedlen — and reboot into the patched kernel. Prioritise container hosts, build infrastructure and other multi-tenant systems where untrusted local code runs; disabling IPv6 removes the trigger path where it is genuinely unused, but only as a stopgap.
How severe is CVE-2026-53362?
CVE-2026-53362 is rated High with a CVSS 3.1 base score of 7.8. It requires local access but only unprivileged user rights, needs no user interaction, and corrupts kernel heap memory — specifically the skb_shared_info structure — with high confidentiality, integrity and availability impact, making full root compromise the realistic outcome on an affected system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.