CVE-2026-53362

CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel's IPv6 output path: __ip6_append_data() mis-accounts fraggap bytes on the paged-allocation branch, leaving the new skb's linear area undersized so the copy of carried-over fragment-gap data spills past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger the corruption by sending over a UDPv6 socket using MSG_MORE combined with MSG_SPLICE_PAGES; the bad accounting was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became triggerable when commit ce650a166335 allowed the MSG_SPLICE_PAGES case to proceed instead of returning -EINVAL. Successful triggering causes kernel memory corruption that, per the high confidentiality/integrity/availability scores, can lead to loss of data confidentiality, integrity and availability — potentially local privilege escalation or a system crash. Any Linux system running a kernel with the affected code is exposed; the source data provides no specific affected version numbers, only the introducing and trigger commits. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, indicating known in-the-wild exploitation (ransomware use unknown), with EPSS at 0.5% and no public PoC known.

What to do: Apply the kernel fix per vendor instructions: upgrade to Linux kernel builds containing the fraggap-accounting resolution for __ip6_append_data(), following CISA's BOD 26-04 patching requirements (for cloud services, follow BOD guidance or discontinue use if mitigations are unavailable); no fixed version numbers were provided in the source data, so confirm with your distribution/vendor that the fix commit is included. Until patched, prioritize multi-user hosts and systems where untrusted local users can open UDPv6 sockets, since exploitation requires local unprivileged access with MSG_MORE and MSG_SPLICE_PAGES. Track KEV-required remediation deadlines, as the flaw is cataloged as exploited in the wild (added 2026-08-27).