Loading vulnerability…
Linux Kernel IPv4 UDP Corking Heap Out-of-Bounds Write
CVE-2026-53366 is a heap out-of-bounds write in the Linux kernel IPv4 UDP corking path affecting unpatched kernels from version 6.1 onward. In __ip_append_data(), the paged-allocation branch fails to include carried-over fragment-gap bytes in alloclen while incorrectly including them in pagedlen. A subsequent skb_copy_and_csum_bits() operation copies those bytes into an undersized linear area. When a corked UDP datagram crosses a fragment boundary with MSG_SPLICE_PAGES set, an unprivileged local attacker can trigger a controlled 15-byte overwrite into skb_shared_info. The vulnerability is exploitable for local privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unprivileged local attacker can corrupt kernel packet-buffer metadata and potentially escalate privileges. The controlled overwrite can modify nr_frags, causing a stale frags[0] entry from a previous allocation to be treated as an allocated fragment. Kernel memory corruption may also cause instability or denial of service.
If you can’t patch tonight, do this now.
Restrict unprivileged access to user namespaces where operationally feasible, because exploitation of the IPv4 variant requires USERNS. Restrict local execution of untrusted code until the kernel is patched. These measures reduce exposure; no vendor-specified temporary workaround is identified.
Patch, then assume compromise.
Install the distribution's kernel security update addressing CVE-2026-53366 and reboot into the updated kernel. The IPv4 fix is identified by commit eca856950f7c and corrects __ip_append_data() by adding fraggap to alloclen and subtracting it from pagedlen. Distributions maintaining their own backports should verify that they included the IPv4 fix, not only the related IPv6 fix for CVE-2026-53362. Exact fixed versions vary by distribution.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.