CVE-2026-53362

What is the Linux IPv6 stack?

The Linux kernel's IPv6 networking subsystem (net/ipv6/) builds and transmits every IPv6 packet the system sends. The path that assembles outbound datagrams — __ip6_append_data() in net/ipv6/ip6_output.c — is reachable by any local process that can open a socket, including unprivileged processes inside containers and user namespaces. A memory-safety defect on that path is a kernel-level primitive available to anyone with local code execution, which makes it a prime target for privilege escalation and container-to-host escape.

Overview

CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel IPv6 output path. When an unprivileged local user drives a UDPv6 socket through a specific combination of paged/scatter-gather transmission flags, the kernel miscomputes buffer sizing and writes past the end of a socket buffer (skb) into adjacent kernel memory — corrupting the trailing skb_shared_info structure. Red Hat tracks the issue as an IPv6 fragmentation container escape (RHSB-2026-009). It carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): local vector, low privileges, no user interaction, full confidentiality/integrity/availability impact.

CISA added it to the KEV catalog on 2026-08-27. Vendor and database pages published in July 2026 initially marked it "not known exploited," so the KEV listing is the exploitation signal; no public proof-of-concept or named threat actor has been tied to it, but vendor analyses describe a fully weaponizable exploitation chain.

Affected Versions

The flaw was introduced around kernel 6.0 and fixed across all maintained stable series on 2026-07-04.

Distribution status: Red Hat — RHEL 10 affected (RHSB-2026-009), OpenShift Container Platform not affected (built on RHEL 9). Ubuntu and Debian track the issue in their security trackers; apply distro kernel updates as they ship.

Technical Details

• Location: __ip6_append_data() in net/ipv6/ip6_output.c, in the paged-allocation branch used when MSG_MORE, scatter-gather (NETIF_F_SG), or large fragment-length handling is active.
• Mechanism: when fraggap is non-zero, the linear area of the skb is under-allocated while pagedlen is over-stated by the same amount. The subsequent copy writes past skb->end into skb_shared_info, an out-of-bounds write into attacker-influenced kernel memory.
• Trigger: an unprivileged local user opens a UDPv6 socket combining MSG_MORE with MSG_SPLICE_PAGES. No special capability is required, and the path is reachable from inside a container or user namespace.
• Regression origin: introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc") and made reachable by ce650a166335.
• Weaponization: vendor writeups describe chaining the OOB write into a dirty pagetable primitive to obtain arbitrary kernel read/write, overwriting process credentials to uid=0, patching avc_denied() to bypass SELinux, and escaping a container to the host via core_pattern. This makes multi-tenant and container hosts the highest-risk deployments.

Discovery

No researcher or organization is publicly credited in the Red Hat (RHSB-2026-009), NVD, or third-party writeups; attribution is not publicly established as of this writing. The fix was developed and backported through the upstream kernel stable process.

Exploitation Context

CISA's addition of CVE-2026-53362 to the KEV catalog on 2026-08-27 reflects confirmed real-world exploitation, even though July 2026 vendor pages predated that determination and listed it as not-yet-exploited. No public PoC or named APT, spyware vendor, or ransomware operator has been linked to it in open reporting. The practical risk framing is local privilege escalation and container-to-host escape — most acute on shared/multi-tenant Linux hosts and container platforms where untrusted workloads run with local socket access.

Remediation

1. Update to a fixed stable kernel for your series (see table) and reboot — a running vulnerable kernel remains exploitable until replaced.
2. Apply distro kernel updates as they ship: RHEL 10 (RHSB-2026-009), Ubuntu, and Debian.
3. Interim workaround (Red Hat): disable unprivileged user namespaces with sysctl -w user.max_user_namespaces=0. This blocks the common container-escape trigger but may break rootless containers and sandboxes — validate before deploying broadly.
4. Prioritize multi-tenant and container hosts, where an untrusted local workload can reach the vulnerable path.
5. Hunt for signs of exploitation: unexpected core_pattern changes, anomalous SELinux AVC denials, and unexplained privilege transitions.