Loading vulnerability…
Fraggap (IPv6 Frag Gap) in the Linux kernel
CVE-2026-53362 is a heap-based out-of-bounds write in the Linux kernel's IPv6 UDP corking path. In the paged-allocation branch of __ip6_append_data(), allocation calculations fail to account correctly for fragment-gap bytes carried over from the preceding socket buffer. The new buffer's linear area is undersized by fraggap bytes, while pagedlen is overstated by the same amount. Copying the carried-over bytes consequently writes beyond skb->end into the trailing skb_shared_info structure. An unprivileged local process can trigger the corruption through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES when a corked datagram crosses a fragment boundary. Successful exploitation can enable local privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability permits attacker-controlled corruption of kernel socket-buffer metadata, including a demonstrated controlled 15-byte out-of-bounds write into skb_shared_info. Exploitation can elevate an unprivileged local process to root, compromising system confidentiality and integrity. Kernel crashes, denial of service, and data corruption are also possible. On container hosts, successful exploitation can cross the container-to-host security boundary because containers share the host kernel. Subsequent access to other workloads or infrastructure depends on the compromised host's permissions and connectivity.
If you can’t patch tonight, do this now.
Where operationally acceptable, disable IPv6 using vendor-supported guidance so untrusted processes cannot reach the vulnerable UDPv6 path. Restrict local shell access and execution of untrusted workloads, and use workload security controls to prevent untrusted processes from creating or using UDPv6 sockets. Containerization alone does not mitigate exposure to the shared host kernel. Prioritize patching shared servers, container hosts, Kubernetes worker nodes, and build runners that execute lower-trust code.
Patch, then assume compromise.
Install the distribution-supported kernel security update containing the IPv6 fragment-gap accounting fix, then reboot into the patched kernel unless a vendor-supported live patch has been successfully applied. Fixed upstream stable releases include 6.1.177, 6.6.144, 6.12.95, 6.18.38, and 7.1.3; the fix is also included in the 7.2 development line from 7.2-rc1. Confirm applicability against the vendor's advisory because backported fixes can make earlier-numbered vendor kernels safe. The code fix adds fraggap to alloclen, subtracts it from pagedlen, and removes the MSG_SPLICE_PAGES exception from negative-copy validation. Verify that the running kernel, not merely the installed package, contains the fix.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
85 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.