Loading story…
Two Linux kernel vulnerabilities, CVE-2026-53362 and CVE-2026-53366, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when MSG_SPLICE_PAGES is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect fraggap accounting lets validation be bypassed, leading to corruption of skb_shared_info metadata and manipulation of the nr_frags field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation.
The bugs affect Linux kernels from v6.1 onward. The IPv6 issue requires CONFIG_IPV6=y, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits 736b380e28d0 for IPv6 and eca856950f7c for IPv4, and were released in stable kernel versions including 7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177. Advisories or updates were issued by major distributions including Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Canonical published an Ubuntu security tracker page for CVE-2026-53362, documenting Ubuntu's handling of the Linux kernel Frag Gap vulnerability. This adds an official Ubuntu vendor reference for the flaw separate from previously noted upstream and Red Hat disclosures.
Red Hat stated that CVE-2026-53362 was addressed via RHSA advisories for Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, and NVIDIA for RHEL 10. The Bugzilla entry also summarized the IPv6 __ip6_append_data() memory-corruption flaw and its fix.
An oss-sec disclosure detailed the root cause of the Linux kernel UDP out-of-bounds write issues, explaining incorrect fraggap accounting in IPv6 and IPv4 append-data paths and the resulting controlled overwrite of skb_shared_info. The post assessed the bugs as exploitable for local privilege escalation by an unprivileged local user under the stated conditions.
The vulnerable UDP fragment-boundary handling that led to CVE-2026-53362 and CVE-2026-53366 was introduced starting with Linux kernel v6.1. The flaws affect IPv6 and IPv4 UDP paths when MSG_SPLICE_PAGES is used in corked datagrams crossing a fragment boundary.
OpenNet disclosed two newly assigned CVEs, CVE-2026-53362 and CVE-2026-53366, describing local privilege-escalation flaws in Linux UDP handling dubbed Frag Gap. The report said major Linux distributions, including Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora, had issued or were preparing advisories and updates.
Fixes for the IPv6 and IPv4 Frag Gap vulnerabilities were published on June 21, including commits 736b380e28d0 for IPv6 and eca856950f7c for IPv4. OpenNet reports the fixes were released in stable kernel versions 7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesecurity-tracker.debian.org
Open sourceblog.qwerty.or.kr
Open sourcepeople.canonical.com
Open sourcegit.kernel.org
Open sourceseclists.org
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026