CVE-2026-53362

This is a flaw in how the Linux system handles certain IPv6 network packets that are split into fragments. If a normal user on the same machine sends the right kind of IPv6 UDP packets, the kernel can mis-handle memory and let that user gain higher privileges or crash the system—like slipping a thin tool into a space that was only meant to fit something smaller.

This matters to you if you run Linux servers, desktops, or appliances where a normal (low-privileged) local user could be present—such as on shared machines, some customer/contractor environments, or multi-tenant setups. It also matters if IPv6 is enabled and local users can send IPv6 UDP traffic.

This is primarily a risk when an attacker already has standard user access on the machine (it is not a purely remote-from-the-internet issue).

This is RED because it’s been confirmed in CISA KEV and real-world exploitation has been reported (including privilege escalation). Attackers can use this to escalate from low privileges to control the system or to cause crashes, so delays directly increase risk.

CISA’s remediation due date is 2026-08-30.

Confirm exposure

1. For each Linux host, record:
   • Running kernel version (and distro name/version)
   • Whether IPv6 is enabled (usually “enabled” unless explicitly disabled)
   • Whether there are any realistic paths for untrusted people/processes to obtain a standard local user account.
2. Compare the kernel version to the fixed releases:
   • Fixed in 6.1.177.
   • Also fixed via the upstream commit IDs provided by your vendor/distro (from the fix list in the advisory): 14200d435af9a9eeb444f529fc2f689a236b7962, 46f201f8b4c39633a1fa3dc12459f506d470993d, 6374fb9edf72c67a118a2c214a0dddd04c921e0a, 65fb14cbebb0cd0eff903a22d33537ddc8b95769, 736b380e28d0480c7bc3e022f1950f31fe53a7c5, e9eacf19281ea2498b36291b56c9606118c2d74e.
3. If your environment uses containers, also check the host kernel (containers share the host kernel).

Patch / upgrade

4. Upgrade to the distro’s patched Linux kernel package for your release, ensuring the resulting runtime kernel is at least 6.1.177 (or includes the corresponding upstream fix commit).
5. Reboot into the new kernel and confirm the running kernel version matches the upgraded package.

If you can’t patch immediately (temporary risk reduction)

6. Reduce the likelihood of a local low-privileged attacker:
   • Remove or lock down accounts that don’t need to be local users.
   • Restrict who can obtain shell access on the host.
   • Reduce exposure in multi-tenant/container scenarios where untrusted workloads might reach local network socket APIs.
7. Apply network and host hardening controls consistent with your standard security baseline while you wait for the kernel update.

Monitoring after remediation

8. Look for signs of local privilege escalation attempts and instability:
   • Unexpected sudo/root usage or sudden changes in accounts/permissions
   • Crashes/restarts shortly after network activity
   • Spikes in local IPv6 UDP traffic (especially abnormal patterns) around the time of alerts/investigations.

Timeline

9. Prioritize this ahead of the 2026-08-30 CISA KEV due date.

CVE-2026-53362 (CWE-787, CWE-122) is a Linux kernel IPv6 memory accounting bug on the paged allocation path, where the kernel miscomputes buffer space when handling fraggap bytes for fragmented IPv6 UDP traffic using MSG_MORE together with MSG_SPLICE_PAGES. The incorrect accounting results in memory corruption (overwrite beyond intended bounds), which can enable privilege escalation or denial-of-service (crash).

Exploit status: Confirmed exploitation in real-world reporting and listed in CISA KEV (added 2026-08-27), indicating active risk beyond theoretical exposure.

Patch status: Fixed in kernel 6.1.177 and several upstream stable commit revisions listed in the findings; upgrading to a vendor-provided kernel build containing these fixes is the recommended route. No public exploit code is noted in the findings, but exploitation has still been observed.