SYS::ONLINE
Wasteland.
Briefs2300
Issues25
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-53362 2026-08-27

CVE-2026-53362: Linux Kernel IPv6 Heap Overflow Added to CISA KEV

"CISA added CVE-2026-53362 to the Known Exploited Vulnerabilities catalog on 2026-08-27, confirming active exploitation of a Linux kernel IPv6 flaw that lets an unprivileged local user corrupt heap memory and escalate…"

CISA added CVE-2026-53362 to the Known Exploited Vulnerabilities catalog on 2026-08-27, confirming active exploitation of a Linux kernel IPv6 flaw that lets an unprivileged local user corrupt heap memory and escalate privileges.

What Is It

The bug lives in __ip6_append_data() in net/ipv6/ip6_output.c. On the paged-allocation path (taken with MSG_MORE, NETIF_F_SG, or a large fraglen), the kernel computes alloclen = fragheaderlen + transhdrlen and pagedlen = datalen - transhdrlen. Because datalen already includes fraggap, a non-zero fraggap leaves the skb's linear area undersized by exactly that many bytes while pagedlen is overstated by the same amount. The copy of carried-over bytes then writes past skb->end into the trailing skb_shared_info.

NVD tracks it as CWE-787 (out-of-bounds write), with CWE-122 (heap-based buffer overflow) as a secondary weakness. CVSS 3.1 base score is 7.8 (HIGH), vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Why It Matters

An unprivileged user can reach the overflow through a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, and the CVSS vector reflects that no special capabilities or user interaction are required; though whether a given system is reachable in practice depends on local hardening such as unprivileged namespace restrictions, seccomp filtering, and IPv6 availability. CISA's SSVC assessment records exploitation as active with total technical impact, and the KEV entry describes it as allowing privilege escalation via the IPv6 networking subsystem. Known ransomware campaign use is listed as Unknown.

What's Vulnerable

The flawed accounting originates with commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"), so any tree carrying that commit, upstream or backported, should be treated as a candidate. Commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES") made the corruption reachable by allowing MSG_SPLICE_PAGES to proceed instead of returning -EINVAL.

Fixes were issued for the currently maintained stable branches: 6.1.x before 6.1.177, 6.6.x before 6.6.144, 6.12.x before 6.12.95, 6.18.x before 6.18.38, and 7.1.x before 7.1.3. Note that 6.1 is the oldest branch still under stable maintenance, so its appearance as the lower bound reflects which branches receive fixes rather than a determination that the defect was absent before it. Kernels older than 6.1 are outside the published fix set and should not be assumed unaffected without checking whether the introducing commit is present in the specific tree.

CISA notes the flaw impacts multiple downstream products, including but not limited to SUSE, Red Hat, and other Linux-based products. Distribution kernels backport heavily, so vendor advisories, not upstream version numbers alone, should drive triage on enterprise builds.

Patch Status

Fixed in 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2. The fix adds fraggap to alloclen and subtracts it from pagedlen, aligning the paged branch with the non-paged branch.

KEV required action is due 2026-08-30: apply mitigations per vendor instructions in compliance with CISA BOD 26-04 and the Forensics Triage Requirements, follow BOD 26-04 cloud-service guidance, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure.

Sources