CVE-2026-53362: Linux Kernel IPv6 Memory Corruption in Packet Fragmentation

Technical summary

CVE-2026-53362 is a memory corruption vulnerability in the Linux kernel's __ip6_append_data() function. The vulnerability occurs in the paged-allocation branch when processing IPv6 packets with fragmentation. The issue involves incorrect calculation of alloclen and pagedlen variables: datalen already includes fraggap bytes, but the code fails to account for this when computing alloclen, resulting in undersized linear buffer allocation. Simultaneously, pagedlen becomes overstated by the same amount. When the kernel copies fraggap bytes into the new skb's linear area, the copy operation writes past skb->end into skb_shared_info, corrupting kernel memory. The vulnerability was introduced by commit 773ba4fe9104 and became exploitable after commit ce650a166335, which removed a safeguard that previously returned -EINVAL for this condition. The fix adds fraggap to alloclen and subtracts it from pagedlen to restore correct sizing.

Business impact

This vulnerability allows unprivileged local users to corrupt kernel memory, potentially leading to denial of service, privilege escalation, or information disclosure. Organizations running multi-user Linux systems or containerized environments where untrusted users can create UDP sockets face elevated risk. The flaw does not require special capabilities, making it accessible to any user with network socket privileges. Successful exploitation could compromise system stability and security, requiring system restart and potential recovery procedures.

Affected systems

The vulnerability affects the Linux kernel. Exact affected versions depend on when commit 773ba4fe9104 was merged into the kernel branch you are running and whether commit ce650a166335 has been applied. Organizations should check the kernel version, build date, and vendor-specific kernel patches to determine if their systems are vulnerable. Verify against the Linux kernel security advisory and your distribution's security bulletins for specific version ranges and available patches.

Exploitability

Exploitability is relatively high for systems with unprivileged users. An attacker requires only local access and the ability to create UDP sockets—capabilities typically available to any user account on multi-user systems. Exploitation requires no special privileges (PR:L indicates low privilege), no user interaction, and minimal attack complexity. The attack surface includes any system accepting IPv6 UDP traffic where MSG_MORE and MSG_SPLICE_PAGES options can be combined. Container and cloud environments are particularly vulnerable if they allow unprivileged workloads to create raw sockets.

Remediation

Apply the upstream Linux kernel patch that corrects the alloclen and pagedlen calculations by adding fraggap to alloclen and subtracting it from pagedlen. This fix also removes the now-obsolete MSG_SPLICE_PAGES exception from the negative copy check. Verify the fix against the official Linux kernel repository and your distribution's security advisories to identify the specific kernel version containing the patch. If immediate patching is not possible, restrict UDP socket creation on multi-user systems via SELinux, AppArmor, or seccomp policies, though this may impact legitimate applications.

Patch guidance

Monitor your Linux distribution's security announcements for kernel updates addressing CVE-2026-53362. Apply the patched kernel version as soon as it becomes available for your distribution. Test the update in a non-production environment first to ensure compatibility with your workloads. Verify that the kernel version in use includes the fix that adjusts alloclen and pagedlen calculations in __ip6_append_data(). Document the patch date and version in your change management system. After patching, reboot systems to load the new kernel.

Detection guidance

Detection of successful exploitation attempts is challenging without kernel debugging enabled. Monitor system logs for unexpected kernel panics, memory corruption errors, or crashes correlating with UDP traffic patterns. Enable kernel audit logging to track socket creation by unprivileged users using MSG_SPLICE_PAGES options if your monitoring tools support this granularity. Network-based detection is impractical since the attack is triggered locally. Prioritize detection through patch compliance scanning to identify unpatched systems rather than attempting to detect active exploitation after the fact.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH severity, local attack surface, and lack of special privilege requirements. The combination of memory corruption (potential for privilege escalation), ease of exploitation by unprivileged users, and broad applicability across Linux deployments creates significant risk. Systems with shared access or container environments should be patched first. Although KEV status is currently false, the vulnerability's inherent exploitability makes it a natural candidate for rapid weaponization and active exploitation once public awareness increases.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) due to the requirement for local access, low attack complexity (AC:L) as the condition is straightforward to trigger, low privilege requirement (PR:L) as unprivileged users can exploit it, no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality (C:H), integrity (I:H), and availability (A:H) through memory corruption. The score does not incorporate exploitability or remediation timelines but represents the inherent severity of successful exploitation.

Frequently asked questions