CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEV

CVE-2026-53362 ("ipv6_frag_escape") (TL-2026-2220), also tracked as ipv6_frag_escape, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-08-29. It has no confirmed attribution, affects Linux Kernel Community Linux kernel, references 1 CVE (CVE-2026-53362), maps to 8 MITRE ATT&CK techniques (T1059, T1082, T1499.004), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2220

Threat ID
TL-2026-2220
Also known as
ipv6_frag_escape, IPv6 Frag Escape, Fraggap
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-29
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
13

A length-accounting bug in the Linux kernel's IPv6 fragmentation path (__ip6_append_data()) lets an unprivileged local process trigger a 15-byte out-of-bounds write into skb_shared_info over a UDPv6 socket, which a public exploit chain converts into a page use-after-free, a Dirty-Pagetable arbitrary kernel read/write primitive, and ultimately root on the host via credential forgery, SELinux bypass, and a core_pattern hijack. CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming active in-the-wild exploitation, with a federal remediation deadline of 2026-08-30.

How CVE-2026-53362 ("ipv6_frag_escape") works

CVE-2026-53362, publicly tracked by researchers as "ipv6_frag_escape" or "Fraggap," is a memory-corruption vulnerability in the Linux kernel's IPv6 output path. Red Hat's advisory (RHSB-2026-009) and Bugzilla 2495904 describe the root cause as an arithmetic error in __ip6_append_data() (net/ipv6/ip6_output.c): when a fragmented IPv6 datagram is built over a corked UDP socket using MSG_MORE together with MSG_SPLICE_PAGES, the code computes `alloclen = fragheaderlen + transhdrlen` (omitting the fragment-gap bytes, fraggap) while `pagedlen = datalen - transhdrlen` (which includes them), so `copy = datalen - transhdrlen - fraggap - pagedlen` evaluates to `-fraggap` and bypasses length validation. The resulting copy overflows past skb->end into the adjacent skb_shared_info structure — a heap overflow classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). An identical accounting bug exists in IPv4's __ip_append_data(), fixed by the companion commit eca856950f7c.

According to the public technical writeup published by researchers 'qwerty' and 'physicube' (blog.qwerty.or.kr) with accompanying exploit code (qwerty-po/security-research, GitHub), the bug is exploitable end-to-end via a precise heap-grooming sequence: skb_frag_t page descriptors are placed into the kmalloc-704 (skbuff_small_head) slab cache, and 8 holding pipes with tee() are used to pin a target page's refcount at 9; a 'groom' socket is then closed to free the target slab objects, and a second, 384-byte splice() call reuses the freed slot, leaving a stale-but-valid page descriptor in frags[0]. The trigger sets MTU to 1287 and issues a first splice(919 bytes, SPLICE_F_MORE) on a UDP_CORK'd socket to fill the skb to the 1272-byte fragment boundary, then a second splice(20 bytes) forces object reuse and yields copy=-15 — a 15-byte out-of-bounds write via skb_copy_and_csum_bits() that lands on skb_shared_info's nr_frags byte (offset 0x02), flipping it 0→1 and arming the stale frags[0] descriptor. A third append via skb_append_pagefrags() places a second page into frags[1]; socket teardown drops the destructor's references on both fragment slots, and closing the last holding pipe leaves one page dangling — a page use-after-free. An attacker-triggered mmap() page fault causes the allocator to reclaim that freed 4 KiB page as a last-level page-table page (a 'Dirty Pagetable' condition), producing a self-referential PTE and, from it, arbitrary physical/kernel memory read-write. From that primitive, the public exploit chain performs a physical-memory scan to locate the kernel's live /proc/sys/kernel/core_pattern string and overwrites it with the literal payload "|/proc/%P/fd/666 %P", so that a deliberately triggered SIGSEGV invokes the kernel's usermodehelper as root against an inherited file descriptor pointing at the attacker's payload — full host root achieved purely through the core_pattern crash-handler hijack, without needing to forge the caller's kernel credential structure or patch the in-memory SELinux denial path (avc_denied()) in this specific public chain. Red Hat's advisory separately documents direct kernel-credential overwrite and SELinux AVC bypass as additional viable impacts reachable from the same arbitrary-R/W primitive. Exploitation only requires the ability to create UDP sockets and (per Red Hat and AlmaLinux) unprivileged user/network namespaces, both available to ordinary users on default RHEL 10-family and many container configurations via unprivileged user namespaces.

The bug-introducing commit (773ba4fe9104) dates to July 2022; the vulnerable code path itself was dormant until Linux 6.6 introduced the MSG_SPLICE_PAGES handling that makes it reachable. TuxCare/KernelCare place the practically exploitable window at kernel 6.6 through 7.1, fixed upstream in 7.2-rc1 via commits 38becddc, 736b380e28d0, and eca856950f7c. TuxCare/KernelCare discovered the public PoC and independently reproduced host-root exploitation in-house on AlmaLinux 10.2 (6.12.0-211.7.3.el10_2) on 2026-06-29 — 'uid=0 in the init namespace, on the first attempt' — with reproduction also confirmed on CentOS Stream 10 (6.12.0-242.el10) and RHEL 10 (6.12.0-228.el10); RHEL, CentOS Stream, AlmaLinux, Rocky Linux, Oracle Linux, and CloudLinux OS 10 running unpatched 6.12.x kernels are all named as exposed. Ubuntu 24.04 and Debian 13 are not currently weaponizable because CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y collapses the exploit into a kernel crash rather than a working read/write primitive — a property vendors are now recommending as a stopgap mitigation (init_on_alloc=1) where an immediate kernel update or reboot isn't possible, alongside disabling unprivileged user namespaces (sysctl user.max_user_namespaces=0), which breaks rootless Podman/Docker, sandboxed browsers, and Flatpak. OpenShift Container Platform is unaffected because it runs on RHEL 9.

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming real-world exploitation, setting a 2026-08-30 remediation deadline for federal civilian executive branch agencies under BOD 22-01. No specific threat actor, campaign, or sector targeting has been publicly attributed; exploitation is enabled by a fully public, working exploit (qwerty-po/security-research on GitHub) released 2026-07-22, roughly five weeks before the KEV addition.

MITRE ATT&CK techniques used in TL-2026-2220

Execution

T1059 Command and Scripting Interpreter

Discovery

T1082 System Information Discovery

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Privilege Escalation

T1546 Event Triggered Execution; T1611 Escape to Host

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-53362 ("ipv6_frag_escape")

  • Linux Kernel Community — Linux kernel
    Vulnerable versions: 6.6 through 7.1 (bug-introducing commit 773ba4fe9104, 2022-07-12)
    Fixed in: 7.2-rc1 (commits 38becddc, 736b380e28d0, eca856950f7c)
  • Red Hat — Red Hat Enterprise Linux 10
    Vulnerable versions: kernel-6.12.0-228.el10 and earlier unpatched 6.12.x builds
    Fixed in: kernel update via RHSA-2026:34911 / RHSA-2026:34927
  • CentOS — CentOS Stream 10
    Vulnerable versions: kernel-6.12.0-242.el10
    Fixed in: upstream-tracked fix per RHSB-2026-009
  • AlmaLinux OS Foundation — AlmaLinux 10 / AlmaLinux Kitten 10
    Vulnerable versions: kernel 6.12.x prior to 6.12.0-211.28.2.el10_2
    Fixed in: kernel-6.12.0-211.29.1.el10_2 or later
  • Rocky Enterprise Software Foundation / CIQ — Rocky Linux 10 (RLC Pro / RLC Pro Hardened, x86_64)
    Vulnerable versions: kernel 6.12.x / 6.18.x builds prior to CIQ patches (requires 5-level paging / LA57; aarch64 unaffected)
    Fixed in: kernel-6.12.0-211.32.1+2.1.el10_2_ciq; kernel-clk6.12-6.12.95-1.1.el9_clk; kernel-clk6.18-6.18.38-2.1.el9_clk
  • Oracle — Oracle Linux 10
    Vulnerable versions: unpatched 6.12.x kernel builds
    Fixed in: vendor kernel update tracking upstream fix
  • CloudLinux — CloudLinux OS 10
    Vulnerable versions: unpatched 6.12.x kernel builds
    Fixed in: vendor kernel update tracking upstream fix

Remediation for CVE-2026-53362 ("ipv6_frag_escape")

Patches

  • Red Hat: RHSA-2026:34911 / RHSA-2026:34927 (kernel update per RHSB-2026-009)
  • AlmaLinux 10 / Kitten 10: kernel-6.12.0-211.29.1.el10_2 or later (test build kernel-6.12.0-211.28.2.el10_2)
  • Rocky Linux 10 (CIQ RLC Pro): kernel-6.12.0-211.32.1+2.1.el10_2_ciq; CIQ CLK 6.12: kernel-clk6.12-6.12.95-1.1.el9_clk; CIQ CLK 6.18: kernel-clk6.18-6.18.38-2.1.el9_clk

Immediate actions

  • Apply the vendor kernel update for RHEL 10 / CentOS Stream 10 / AlmaLinux 10 / Rocky Linux 10 / Oracle Linux 10 / CloudLinux OS 10 that includes upstream fix commits 38becddc, 736b380e28d0, and eca856950f7c
  • If an immediate reboot is not possible, disable unprivileged user namespaces: sysctl -w user.max_user_namespaces=0
  • Apply a KernelCare/TuxCare rebootless patch where deployed for RHEL 10, Oracle Linux 10, Rocky Linux 10, or AlmaLinux 10

Workarounds

  • sysctl -w user.max_user_namespaces=0 (breaks rootless Podman/Docker, sandboxed browsers, and Flatpak — use only as a temporary measure)
  • Boot with init_on_alloc=1 to reduce exploitability to denial-of-service

Longer-term hardening

  • Track and apply the Red Hat, AlmaLinux, and Rocky Linux/CIQ patched kernel builds as they roll out to all Enterprise Linux 10 family hosts
  • Enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON / boot with init_on_alloc=1 to downgrade any residual exploit attempt to a kernel crash rather than a working read/write primitive
  • Audit /proc/sys/kernel/core_pattern on production hosts for unauthorized modification
  • Monitor for SELinux enforcement gaps where the mode reports 'enforcing' but expected AVC denials silently stop appearing

CVEs associated with CVE-2026-53362 ("ipv6_frag_escape")

CVE-2026-53362

Weaknesses (CWE) in CVE-2026-53362 ("ipv6_frag_escape")

CWE-130

Timeline of CVE-2026-53362 ("ipv6_frag_escape")

  • The bug-introducing commit 773ba4fe9104 lands in the Linux kernel's UDP/IPv6 corking length-accounting code, per the qwerty technical writeup.
  • Researchers privately disclose the flaw to security@kernel.org.
  • The IPv6 fix is merged into the netdev/net upstream tree.
  • The fix is merged into Linux mainline.
  • A public proof-of-concept is released; KernelCare/TuxCare reproduces host-root exploitation on AlmaLinux 10.2 (kernel 6.12.0-211.7.3.el10_2).
  • AlmaLinux ships a patched kernel (6.12.0-211.28.2.el10_2) at 08:51 UTC; KernelCare test-feed rebootless patches begin rolling out for RHEL 10, Oracle Linux 10, Rocky Linux 10, and AlmaLinux 10.
  • Red Hat Bugzilla 2495904 (CVE-2026-53362, 'kernel: ipv6 frag escape') is opened.
  • Red Hat releases its first fix via RHSA-2026:34927.
  • CVE-2026-53362 is formally published.
  • CIQ ships patched CLK 6.12 kernel (kernel-clk6.12-6.12.95-1.1.el9_clk) for Rocky Linux 9.
  • The full technical writeup and exploit code (qwerty-po/security-research) are publicly released, detailing the Dirty-Pagetable / core_pattern container-escape chain.
  • CISA adds CVE-2026-53362 to the Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation.
  • Cyber Security News reports on the CISA KEV addition, driving broader public awareness.
  • Federal Civilian Executive Branch agencies' remediation deadline under BOD 22-01.

Sources cited for CVE-2026-53362 ("ipv6_frag_escape")

More in vulnerability

Detection coverage for TL-2026-2220

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2220 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats