# CVE-2026-53362 — Linux

**CISA KEV**

> As of 2026-08-28, CVE-2026-53362 is a HIGH-severity vulnerability in Linux, CVSS v3.1 7.8, EPSS 0.5% (41.4th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-08-27), with a US federal remediation deadline of 2026-08-30. Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-53362, most recently “CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEV”.

**Last updated:** 2026-08-28

## What is CVE-2026-53362?

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

The record classifies CVE-2026-53362 under weakness class [CWE-122](https://cwe.mitre.org/data/definitions/122.html). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 81 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 7.8 — HIGH (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **EPSS (FIRST):** 0.5% probability of exploitation in the next 30 days, higher than 41.4% of all scored CVEs
- **CISA KEV:** Listed since 2026-08-27, federal remediation deadline 2026-08-30
- **Threadlinqs priority:** 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- **Published:** 2026-07-04, last modified 2026-08-28

## Is CVE-2026-53362 being exploited?

CISA added CVE-2026-53362 to the Known Exploited Vulnerabilities catalog on 2026-08-27, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-08-30 under BOD 22-01. Weaponised exploit code for CVE-2026-53362 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 44 in the Threadlinqs vulnerability feed.

- [suominen/ipv6_frag_escape](https://github.com/suominen/ipv6_frag_escape) (github)

## Affected products and versions

- **Linux**: Linux

## How to fix CVE-2026-53362

The record marks a vendor fix as available for CVE-2026-53362. Patch reference: [https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962](https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962). Because CVE-2026-53362 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-08-30. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

## Threat activity tracking CVE-2026-53362

1 tracked threat in the Threadlinqs corpus references CVE-2026-53362, either in the campaign’s CVE list or as an indicator on the campaign record.

- [CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-2220) — HIGH · 2026-08-29

## Sources

Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-08-31. This product uses the NVD API but is not endorsed or certified by the NVD.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962)
- [git.kernel.org (65fb14cbebb0cd0eff903a22d33537ddc8b95769)](https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769)
- [git.kernel.org (46f201f8b4c39633a1fa3dc12459f506d470993d)](https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d)
- [git.kernel.org (6374fb9edf72c67a118a2c214a0dddd04c921e0a)](https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a)
- [git.kernel.org (e9eacf19281ea2498b36291b56c9606118c2d74e)](https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e)

_Showing 5 of 6 recorded references._

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-53362
Full detection coverage and IOCs for threats exploiting CVE-2026-53362 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp