Linux Kernel UDP Frag Gap Flaws Enable Local Root Escalation

Two Linux kernel vulnerabilities, CVE-2026-53362 and CVE-2026-53366, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when MSG_SPLICE_PAGES is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect fraggap accounting lets validation be bypassed, leading to corruption of skb_shared_info metadata and manipulation of the nr_frags field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation.

The bugs affect Linux kernels from v6.1 onward. The IPv6 issue requires CONFIG_IPV6=y, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits 736b380e28d0 for IPv6 and eca856950f7c for IPv4, and were released in stable kernel versions including 7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177. Advisories or updates were issued by major distributions including Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora.