CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEV

Key facts for Linux IPv6 fragmentation escape

Detection coverage for Linux IPv6 fragmentation escape

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2220 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution

Detects modification of /proc/sys/kernel/core_pattern to a pipe-style usermode-helper payload (leading '|' invoking a path under /proc/%P/fd/) — the exact final-stage technique the public Fraggap exploit chain uses to convert its Dirty-Pagetable arbitrary read/write primitive into root code execution via a deliberately triggered SIGSEGV. Also flags any core_pattern write performed by a process running inside a container/user-namespace context.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1546, T1611, T1068
• Data sources: auditd, microsoft_defender_for_endpoint_linux, sysmon_for_linux
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_audit sourcetype=auditd type=PATH OR type=SYSCALL
| search (name="/proc/sys/kernel/core_pattern" OR (syscall="write" AND path="/proc/sys/kernel/core_pattern")) OR (comm="sysctl" AND args="kernel.core_pattern*")
| eval payload=coalesce(a2, args, _raw)
| eval malicious_pattern=if(match(payload, "^\|.*\/proc\/%?P?\/fd\/") OR match(payload, "\|\/proc\/%P\/fd\/666"), 1, 0)
| where malicious_pattern=1 OR (match(payload, "^\|") AND NOT match(payload, "^\|\s*\/usr\/(lib|libexec)\/systemd-coredump"))
| table _time, host, pid, comm, exe, uid, payload, malicious_pattern
| sort -_time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ "/proc/sys/kernel/core_pattern" and ActionType in ("FileModified", "FileCreated")
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | project WritePid = ProcessId, WriteCmd = ProcessCommandLine, WriteAccountName = AccountName
) on $left.InitiatingProcessId == $right.WritePid
| extend SuspiciousPayload = WriteCmd has "|/proc/" and WriteCmd has "/fd/"
| where SuspiciousPayload or WriteCmd !contains "systemd-coredump"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, WriteCmd, SuspiciousPayload

Sigma

title: CVE-2026-53362 Fraggap core_pattern Crash-Handler Hijack
id: 9f4d2a33-6c7e-4a1f-b0d5-2e8c1f9a7b02
status: experimental
description: Detects a write to /proc/sys/kernel/core_pattern setting a pipe-invoked usermode-helper payload pointing at a process's own /proc/<pid>/fd descriptor, the final privilege-escalation step of the public CVE-2026-53362 (Fraggap) exploit chain that triggers root code execution on SIGSEGV.
references:
  - https://access.redhat.com/security/vulnerabilities/RHSB-2026-009
  - https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546
  - attack.t1611
  - attack.t1068
  - cve.2026.53362
  - attack.tool.qwerty_po_exploit
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename: '/proc/sys/kernel/core_pattern'
  selection_payload:
    TargetFilename|contains: 'core_pattern'
  filter_legit:
    CommandLine|contains: 'systemd-coredump'
  condition: selection_path and not filter_legit
falsepositives:
  - Legitimate core-dump handler configuration by systemd-coredump, abrt, or apport during OS provisioning
  - Deliberate administrator reconfiguration of core dump handling
level: critical

Known false positives:

• systemd-coredump, abrt, or apport legitimately (re)configuring core_pattern during OS install or package update
• Administrator-driven core dump handler changes during incident response or debugging setup

Tuning notes: Allowlist the known-good core_pattern values shipped by systemd-coredump/abrt/apport packages on your golden image; any deviation from that allowlist, especially a leading pipe character combined with '/proc/%P/fd/', should page immediately. Correlate with a following SIGSEGV on the same host within seconds to confirm actual exploitation rather than benign reconfiguration.

• 🔒 CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger · unlock with TL Creds
• 🔒 CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery · unlock with TL Creds

Indicators of compromise for Linux IPv6 fragmentation escape

As of 2026-08-29, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2220.

How Linux IPv6 fragmentation escape works

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming active in-the-wild exploitation, with a federal remediation deadline of 2026-08-30.

CVE-2026-53362, publicly tracked by researchers as "ipv6_frag_escape" or "Fraggap," is a memory-corruption vulnerability in the Linux kernel's IPv6 output path. Red Hat's advisory (RHSB-2026-009) and Bugzilla 2495904 describe the root cause as an arithmetic error in __ip6_append_data() (net/ipv6/ip6_output.c): when a fragmented IPv6 datagram is built over a corked UDP socket using MSG_MORE together with MSG_SPLICE_PAGES, the code computes `alloclen = fragheaderlen + transhdrlen` (omitting the fragment-gap bytes, fraggap) while `pagedlen = datalen - transhdrlen` (which includes them), so `copy = datalen - transhdrlen - fraggap - pagedlen` evaluates to `-fraggap` and bypasses length validation. The resulting copy overflows past skb->end into the adjacent skb_shared_info structure — a heap overflow classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). An identical accounting bug exists in IPv4's __ip_append_data(), fixed by the companion commit eca856950f7c.

According to the public technical writeup published by researchers 'qwerty' and 'physicube' (blog.qwerty.or.kr) with accompanying exploit code (qwerty-po/security-research, GitHub), the bug is exploitable end-to-end via a precise heap-grooming sequence: skb_frag_t page descriptors are placed into the kmalloc-704 (skbuff_small_head) slab cache, and 8 holding pipes with tee() are used to pin a target page's refcount at 9; a 'groom' socket is then closed to free the target slab objects, and a second, 384-byte splice() call reuses the freed slot, leaving a stale-but-valid page descriptor in frags[0]. The trigger sets MTU to 1287 and issues a first splice(919 bytes, SPLICE_F_MORE) on a UDP_CORK'd socket to fill the skb to the 1272-byte fragment boundary, then a second splice(20 bytes) forces object reuse and yields copy=-15 — a 15-byte out-of-bounds write via skb_copy_and_csum_bits() that lands on skb_shared_info's nr_frags byte (offset 0x02), flipping it 0→1 and arming the stale frags[0] descriptor. A third append via skb_append_pagefrags() places a second page into frags[1]; socket teardown drops the destructor's references on both fragment slots, and closing the last holding pipe leaves one page dangling — a page use-after-free. An attacker-triggered mmap() page fault causes the allocator to reclaim that freed 4 KiB page as a last-level page-table page (a 'Dirty Pagetable' condition), producing a self-referential PTE and, from it, arbitrary physical/kernel memory read-write. From that primitive, the public exploit chain performs a physical-memory scan to locate the kernel's live /proc/sys/kernel/core_pattern string and overwrites it with the literal payload "|/proc/%P/fd/666 %P", so that a deliberately triggered SIGSEGV invokes the kernel's usermodehelper as root against an inherited file descriptor pointing at the attacker's payload — full host root achieved purely through the core_pattern crash-handler hijack, without needing to forge the caller's kernel credential structure or patch the in-memory SELinux denial path (avc_denied()) in this specific public chain. Red Hat's advisory separately documents direct kernel-credential overwrite and SELinux AVC bypass as additional viable impacts reachable from the same arbitrary-R/W primitive. Exploitation only requires the ability to create UDP sockets and (per Red Hat and AlmaLinux) unprivileged user/network namespaces, both available to ordinary users on default RHEL 10-family and many container configurations via unprivileged user namespaces.

The bug-introducing commit (773ba4fe9104) dates to July 2022; the vulnerable code path itself was dormant until Linux 6.6 introduced the MSG_SPLICE_PAGES handling that makes it reachable. TuxCare/KernelCare place the practically exploitable window at kernel 6.6 through 7.1, fixed upstream in 7.2-rc1 via commits 38becddc, 736b380e28d0, and eca856950f7c. TuxCare/KernelCare discovered the public PoC and independently reproduced host-root exploitation in-house on AlmaLinux 10.2 (6.12.0-211.7.3.el10_2) on 2026-06-29 — 'uid=0 in the init namespace, on the first attempt' — with reproduction also confirmed on CentOS Stream 10 (6.12.0-242.el10) and RHEL 10 (6.12.0-228.el10); RHEL, CentOS Stream, AlmaLinux, Rocky Linux, Oracle Linux, and CloudLinux OS 10 running unpatched 6.12.x kernels are all named as exposed. Ubuntu 24.04 and Debian 13 are not currently weaponizable because CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y collapses the exploit into a kernel crash rather than a working read/write primitive — a property vendors are now recommending as a stopgap mitigation (init_on_alloc=1) where an immediate kernel update or reboot isn't possible, alongside disabling unprivileged user namespaces (sysctl user.max_user_namespaces=0), which breaks rootless Podman/Docker, sandboxed browsers, and Flatpak. OpenShift Container Platform is unaffected because it runs on RHEL 9.

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming real-world exploitation, setting a 2026-08-30 remediation deadline for federal civilian executive branch agencies under BOD 22-01. No specific threat actor, campaign, or sector targeting has been publicly attributed; exploitation is enabled by a fully public, working exploit (qwerty-po/security-research on GitHub) released 2026-07-22, roughly five weeks before the KEV addition.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Discovery

T1082 System Information Discovery

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Privilege Escalation

T1546 Event Triggered Execution; T1611 Escape to Host

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

defense-impairment

T1685 Disable or Modify Tools

Remediation for Linux IPv6 fragmentation escape

Patches

• Red Hat: RHSA-2026:34911 / RHSA-2026:34927 (kernel update per RHSB-2026-009)
• AlmaLinux 10 / Kitten 10: kernel-6.12.0-211.29.1.el10_2 or later (test build kernel-6.12.0-211.28.2.el10_2)
• Rocky Linux 10 (CIQ RLC Pro): kernel-6.12.0-211.32.1+2.1.el10_2_ciq; CIQ CLK 6.12: kernel-clk6.12-6.12.95-1.1.el9_clk; CIQ CLK 6.18: kernel-clk6.18-6.18.38-2.1.el9_clk

Immediate actions

• Apply the vendor kernel update for RHEL 10 / CentOS Stream 10 / AlmaLinux 10 / Rocky Linux 10 / Oracle Linux 10 / CloudLinux OS 10 that includes upstream fix commits 38becddc, 736b380e28d0, and eca856950f7c
• If an immediate reboot is not possible, disable unprivileged user namespaces: sysctl -w user.max_user_namespaces=0
• Apply a KernelCare/TuxCare rebootless patch where deployed for RHEL 10, Oracle Linux 10, Rocky Linux 10, or AlmaLinux 10

Workarounds

• sysctl -w user.max_user_namespaces=0 (breaks rootless Podman/Docker, sandboxed browsers, and Flatpak — use only as a temporary measure)
• Boot with init_on_alloc=1 to reduce exploitability to denial-of-service

Longer-term hardening

• Track and apply the Red Hat, AlmaLinux, and Rocky Linux/CIQ patched kernel builds as they roll out to all Enterprise Linux 10 family hosts
• Enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON / boot with init_on_alloc=1 to downgrade any residual exploit attempt to a kernel crash rather than a working read/write primitive
• Audit /proc/sys/kernel/core_pattern on production hosts for unauthorized modification
• Monitor for SELinux enforcement gaps where the mode reports 'enforcing' but expected AVC denials silently stop appearing

Affected and fixed versions

• Linux Kernel Community — Linux kernel
  Vulnerable versions: 6.6 through 7.1 (bug-introducing commit 773ba4fe9104, 2022-07-12)
  Fixed in: 7.2-rc1 (commits 38becddc, 736b380e28d0, eca856950f7c)
• Red Hat — Red Hat Enterprise Linux 10
  Vulnerable versions: kernel-6.12.0-228.el10 and earlier unpatched 6.12.x builds
  Fixed in: kernel update via RHSA-2026:34911 / RHSA-2026:34927
• CentOS — CentOS Stream 10
  Vulnerable versions: kernel-6.12.0-242.el10
  Fixed in: upstream-tracked fix per RHSB-2026-009
• AlmaLinux OS Foundation — AlmaLinux 10 / AlmaLinux Kitten 10
  Vulnerable versions: kernel 6.12.x prior to 6.12.0-211.28.2.el10_2
  Fixed in: kernel-6.12.0-211.29.1.el10_2 or later
• Rocky Enterprise Software Foundation / CIQ — Rocky Linux 10 (RLC Pro / RLC Pro Hardened, x86_64)
  Vulnerable versions: kernel 6.12.x / 6.18.x builds prior to CIQ patches (requires 5-level paging / LA57; aarch64 unaffected)
  Fixed in: kernel-6.12.0-211.32.1+2.1.el10_2_ciq; kernel-clk6.12-6.12.95-1.1.el9_clk; kernel-clk6.18-6.18.38-2.1.el9_clk
• Oracle — Oracle Linux 10
  Vulnerable versions: unpatched 6.12.x kernel builds
  Fixed in: vendor kernel update tracking upstream fix
• CloudLinux — CloudLinux OS 10
  Vulnerable versions: unpatched 6.12.x kernel builds
  Fixed in: vendor kernel update tracking upstream fix

Timeline of Linux IPv6 fragmentation escape

• 2022-07-12 The bug-introducing commit locked-ioc-10 lands in the Linux kernel's UDP/IPv6 corking length-accounting code, per the qwerty technical writeup.
• 2026-05-15 Researchers privately disclose the flaw to security@kernel.org.
• 2026-06-21 The IPv6 fix is merged into the netdev/net upstream tree.
• 2026-06-25 The fix is merged into Linux mainline.
• 2026-06-29 A public proof-of-concept is released; KernelCare/TuxCare reproduces host-root exploitation on AlmaLinux 10.2 (kernel 6.12.0-211.7.3.el10_2).
• 2026-06-30 AlmaLinux ships a patched kernel (6.12.0-211.28.2.el10_2) at 08:51 UTC; KernelCare test-feed rebootless patches begin rolling out for RHEL 10, Oracle Linux 10, Rocky Linux 10, and AlmaLinux 10.
• 2026-07-01 locked-ioc-12 Bugzilla 2495904 (CVE-2026-53362, 'kernel: ipv6 frag escape') is opened.
• 2026-07-02 locked-ioc-12 releases its first fix via RHSA-2026:34927.
• 2026-07-04 CVE-2026-53362 is formally published.
• 2026-07-06 CIQ ships patched CLK 6.12 kernel (kernel-clk6.12-6.12.95-1.1.el9_clk) for Rocky Linux 9.
• 2026-07-22 The full technical writeup and exploit code (qwerty-po/security-research) are publicly released, detailing the Dirty-Pagetable / core_pattern container-escape chain.
• 2026-08-27 locked-ioc-13 adds CVE-2026-53362 to the Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation.
• 2026-08-28 Cyber Security News reports on the locked-ioc-13 KEV addition, driving broader public awareness.
• 2026-08-30 Federal Civilian Executive Branch agencies' remediation deadline under BOD 22-01.

Sources cited for Linux IPv6 fragmentation escape

• Red Hat CVE-2026-53362 Security Summary access.redhat.com · Advisory
• Red Hat Security Bulletin RHSB-2026-009: IPv6 Fragmentation Container Escape - Linux Kernel (CVE-2026-53362) access.redhat.com · Advisory
• NVD CVE-2026-53362 Detail NVD (NIST) · Advisory
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-08-27
• Red Hat Security Advisory RHSA-2026:34911 access.redhat.com · Advisory
• Red Hat Bugzilla 2495904 — CVE-2026-53362 kernel: ipv6 frag escape bugzilla.redhat.com · Vendor report · 2026-07-01
• CIQ Knowledge Base: Mitigating IPv6 Frag Escape (CVE-2026-53362) on Rocky Linux 10 kb.ciq.com · Vendor report
• qwerty: CVE-2026-53362 (Fraggap) Technical Exploitation Writeup blog.qwerty.or.kr · Research · 2026-07-22
• GitHub: qwerty-po/security-research — CVE-2026-53362 exploit code GitHub · Code repository · 2026-07-22
• AlmaLinux: IPV6_FRAG_ESCAPE vulnerability: Fixed! almalinux.org · Blog · 2026-06-30
• TuxCare: The IPv6 Fragmentation Flaw That Breaks Container Isolation Across EL10 tuxcare.com · Blog · 2026-06-30
• Cyber Security News: CISA Warns of Linux Kernel Privilege Escalation Vulnerability Exploited in Attacks cybersecuritynews.com · News · 2026-08-28

Threats related to Linux IPv6 fragmentation escape

• CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
• CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege Escalation
• Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host
• Broadcom Patches Critical VMware Workstation and Fusion VM Escape Vulnerabilities (CVE-2026-59346, CVE-2026-59347)
• Claude Mythos / Project Glasswing: Autonomous AI Vulnerability Discovery Compresses the Find-to-Exploit Timeline (CVE-2026-4747 and the AI-Scale Disclosure Problem)

Related coverage of this activity

• Chrome 151 security update
• SCTPhantom Linux kernel privilege escalation
• IonStack Android 17 root chain
• Zscaler Client Connector RCE flaws
• AMD Ionic Driver VMware ESX

Previous and next in vulnerability

• Five Critical WordPress Plugin/Theme Flaws (CVSS up to 10.0) Enable Site Takeover or RCE: WPMU DEV Dashboard, Avada/Fusion Builder, TranslatePress, Pods, GiveWP Previous report
• Pre-Authentication Remote Code Execution in SPIP CMS (CVE-2026-77806) — Actively Exploited Next report