CVE-2026-53362: Linux kernel IPv6 UDP fragment out-of-bounds write (ipv6_frag_escape)

Exploited in the wild High 7.8 EPSS 0.7% Linux kernel

__ip6_append_data() in the IPv6 output path undersizes the buffer when a corked UDPv6 datagram crosses a fragment boundary while MSG_SPLICE_PAGES is used (for example splice() from a pipe into a UDP socket), giving a controlled 15-byte out-of-bounds write into skb_shared_info. A local unprivileged user can turn this into root, and Red Hat says it can be used to escape a container and bypass SELinux. Linux 6.0 and later are affected (RHEL 8 and 9 are not); CISA added it to KEV on 27 August 2026.

Also known as “ipv6_frag_escape”.

• CVE-2026-53362CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2026-08-27added to CISA's exploited list (US federal deadline 2026-08-30)
• 0.7%EPSS: chance of exploitation in the next 30 days (higher than 54% of CVEs)
• 2026-07-04published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 6.0 through 6.1.176
• Linux 6.2 through 6.6.143
• Linux 6.7 through 6.12.94
• Linux 6.13 through 6.18.37
• Linux 6.19 through 7.1.2

Fixed in:

• Linux 6.1.177
• Linux 6.6.144
• Linux 6.12.95
• Linux 6.18.38
• Linux 7.1.3
• Linux 7.2

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)
sysctl user.max_user_namespaces

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot
# Debian 11 'linux' (5.10) is not affected; only the linux-6.1 backport needs updating there.

sudo apt update
sudo apt upgrade
sudo reboot
# Ubuntu 22.04 GA and older are not affected. As of 3 Nov 2026 Ubuntu lists 22.04 HWE 6.8 as 'pending' and 24.04 HWE 6.17 as 'needed'.

# Only RHEL 10 is affected (RHEL 8 and 9 are not, per Red Hat).
sudo dnf upgrade kernel
sudo reboot
# RHEL 10.2 kpatch: sudo dnf install "kpatch-patch = $(uname -r)"

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
sudo reboot
# Amazon Linux 2 kernels are not affected.

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat (RHSB-2026-009): exploitation needs the ability to create network namespaces, so disabling unprivileged user namespaces reduces exposure: sudo sysctl -w user.max_user_namespaces=0 and persist with echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-disable-userns.conf. This breaks rootless Podman and some sandboxes, and Red Hat says it does not fix the bug. The reporters say the IPv6 variant needs only CONFIG_IPV6=y, so treat this as a stopgap and install the kernel update.

Related vulnerabilities

• CVE-2026-53366

Sources

• CVE record CVE-2026-53362
• NVD CVE-2026-53362
• CISA KEV entry CVE-2026-53362
• Debian security tracker CVE-2026-53362
• Ubuntu CVE page CVE-2026-53362
• Red Hat CVE page CVE-2026-53362
• SUSE CVE page CVE-2026-53362
• Amazon Linux ALAS CVE page CVE-2026-53362
• Red Hat RHSB-2026-009 ipv6_frag_escape bulletin
• oss-security: CVE-2026-53362, CVE-2026-53366 OOB write in UDP MSG_SPLICE_PAGES
• Upstream fix (ipv6: account for fraggap on the paged allocation path)
• https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962
• https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769
• https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d
• https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a
• https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.