# CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEV

> A length-accounting bug in the Linux kernel's IPv6 fragmentation path (__ip6_append_data()) lets an unprivileged local process trigger a 15-byte out-of-bounds write into skb_shared_info over a UDPv6 socket, which a public exploit chain converts into a page use-after-free, a Dirty-Pagetable arbitrary kernel read/write primitive, and ultimately root on the host via credential forgery, SELinux bypass, and a core_pattern hijack. CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming active in-the-wild exploitation, with a federal remediation deadline of 2026-08-30.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2220
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-linux-ipv6-fragmentation-escape-tl-2026-2220.webp?v=f33a5a5c (Threadlinqs threat intel: CVE-2026-53362 Linux ipv6 container escape: Detection & IOCs (TL-2026-2220) — High severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-2220
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13
- **CVEs:** CVE-2026-53362

## Description

CVE-2026-53362, publicly tracked by researchers as "ipv6_frag_escape" or "Fraggap," is a memory-corruption vulnerability in the Linux kernel's IPv6 output path. Red Hat's advisory (RHSB-2026-009) and Bugzilla 2495904 describe the root cause as an arithmetic error in __ip6_append_data() (net/ipv6/ip6_output.c): when a fragmented IPv6 datagram is built over a corked UDP socket using MSG_MORE together with MSG_SPLICE_PAGES, the code computes `alloclen = fragheaderlen + transhdrlen` (omitting the fragment-gap bytes, fraggap) while `pagedlen = datalen - transhdrlen` (which includes them), so `copy = datalen - transhdrlen - fraggap - pagedlen` evaluates to `-fraggap` and bypasses length validation. The resulting copy overflows past skb->end into the adjacent skb_shared_info structure — a heap overflow classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). An identical accounting bug exists in IPv4's __ip_append_data(), fixed by the companion commit eca856950f7c.

According to the public technical writeup published by researchers 'qwerty' and 'physicube' (blog.qwerty.or.kr) with accompanying exploit code (qwerty-po/security-research, GitHub), the bug is exploitable end-to-end via a precise heap-grooming sequence: skb_frag_t page descriptors are placed into the kmalloc-704 (skbuff_small_head) slab cache, and 8 holding pipes with tee() are used to pin a target page's refcount at 9; a 'groom' socket is then closed to free the target slab objects, and a second, 384-byte splice() call reuses the freed slot, leaving a stale-but-valid page descriptor in frags[0]. The trigger sets MTU to 1287 and issues a first splice(919 bytes, SPLICE_F_MORE) on a UDP_CORK'd socket to fill the skb to the 1272-byte fragment boundary, then a second splice(20 bytes) forces object reuse and yields copy=-15 — a 15-byte out-of-bounds write via skb_copy_and_csum_bits() that lands on skb_shared_info's nr_frags byte (offset 0x02), flipping it 0→1 and arming the stale frags[0] descriptor. A third append via skb_append_pagefrags() places a second page into frags[1]; socket teardown drops the destructor's references on both fragment slots, and closing the last holding pipe leaves one page dangling — a page use-after-free. An attacker-triggered mmap() page fault causes the allocator to reclaim that freed 4 KiB page as a last-level page-table page (a 'Dirty Pagetable' condition), producing a self-referential PTE and, from it, arbitrary physical/kernel memory read-write. From that primitive, the public exploit chain performs a physical-memory scan to locate the kernel's live /proc/sys/kernel/core_pattern string and overwrites it with the literal payload "|/proc/%P/fd/666 %P", so that a deliberately triggered SIGSEGV invokes the kernel's usermodehelper as root against an inherited file descriptor pointing at the attacker's payload — full host root achieved purely through the core_pattern crash-handler hijack, without needing to forge the caller's kernel credential structure or patch the in-memory SELinux denial path (avc_denied()) in this specific public chain. Red Hat's advisory separately documents direct kernel-credential overwrite and SELinux AVC bypass as additional viable impacts reachable from the same arbitrary-R/W primitive. Exploitation only requires the ability to create UDP sockets and (per Red Hat and AlmaLinux) unprivileged user/network namespaces, both available to ordinary users on default RHEL 10-family and many container configurations via unprivileged user namespaces.

The bug-introducing commit (773ba4fe9104) dates to July 2022; the vulnerable code path itself was dormant until Linux 6.6 introduced the MSG_SPLICE_PAGES handling that makes it reachable. TuxCare/KernelCare place the practically exploitable window at kernel 6.6 through 7.1, fixed upstream in 7.2-rc1 via commits 38becddc, 736b380e28d0, and eca856950f7c. TuxCare/KernelCare discovered the public PoC and independently reproduced host-root exploitation in-house on AlmaLinux 10.2 (6.12.0-211.7.3.el10_2) on 2026-06-29 — 'uid=0 in the init namespace, on the first attempt' — with reproduction also confirmed on CentOS Stream 10 (6.12.0-242.el10) and RHEL 10 (6.12.0-228.el10); RHEL, CentOS Stream, AlmaLinux, Rocky Linux, Oracle Linux, and CloudLinux OS 10 running unpatched 6.12.x kernels are all named as exposed. Ubuntu 24.04 and Debian 13 are not currently weaponizable because CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y collapses the exploit into a kernel crash rather than a working read/write primitive — a property vendors are now recommending as a stopgap mitigation (init_on_alloc=1) where an immediate kernel update or reboot isn't possible, alongside disabling unprivileged user namespaces (sysctl user.max_user_namespaces=0), which breaks rootless Podman/Docker, sandboxed browsers, and Flatpak. OpenShift Container Platform is unaffected because it runs on RHEL 9.

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27 after confirming real-world exploitation, setting a 2026-08-30 remediation deadline for federal civilian executive branch agencies under BOD 22-01. No specific threat actor, campaign, or sector targeting has been publicly attributed; exploitation is enabled by a fully public, working exploit (qwerty-po/security-research on GitHub) released 2026-07-22, roughly five weeks before the KEV addition.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1587.004 Develop Capabilities: Exploits
- T1082 System Information Discovery
- T1611 Escape to Host
- T1546 Event Triggered Execution
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution** (`TL-2026-2220-SPL-002`)

Detects modification of /proc/sys/kernel/core_pattern to a pipe-style usermode-helper payload (leading '|' invoking a path under /proc/%P/fd/) — the exact final-stage technique the public Fraggap exploit chain uses to convert its Dirty-Pagetable arbitrary read/write primitive into root code execution via a deliberately triggered SIGSEGV. Also flags any core_pattern write performed by a process running inside a container/user-namespace context.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1546, T1611, T1068
- **Data sources:** auditd, microsoft_defender_for_endpoint_linux, sysmon_for_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux_audit sourcetype=auditd type=PATH OR type=SYSCALL
| search (name="/proc/sys/kernel/core_pattern" OR (syscall="write" AND path="/proc/sys/kernel/core_pattern")) OR (comm="sysctl" AND args="kernel.core_pattern*")
| eval payload=coalesce(a2, args, _raw)
| eval malicious_pattern=if(match(payload, "^\|.*\/proc\/%?P?\/fd\/") OR match(payload, "\|\/proc\/%P\/fd\/666"), 1, 0)
| where malicious_pattern=1 OR (match(payload, "^\|") AND NOT match(payload, "^\|\s*\/usr\/(lib|libexec)\/systemd-coredump"))
| table _time, host, pid, comm, exe, uid, payload, malicious_pattern
| sort -_time
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ "/proc/sys/kernel/core_pattern" and ActionType in ("FileModified", "FileCreated")
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | project WritePid = ProcessId, WriteCmd = ProcessCommandLine, WriteAccountName = AccountName
) on $left.InitiatingProcessId == $right.WritePid
| extend SuspiciousPayload = WriteCmd has "|/proc/" and WriteCmd has "/fd/"
| where SuspiciousPayload or WriteCmd !contains "systemd-coredump"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, WriteCmd, SuspiciousPayload
```

### Sigma

```yaml
title: CVE-2026-53362 Fraggap core_pattern Crash-Handler Hijack
id: 9f4d2a33-6c7e-4a1f-b0d5-2e8c1f9a7b02
status: experimental
description: Detects a write to /proc/sys/kernel/core_pattern setting a pipe-invoked usermode-helper payload pointing at a process's own /proc/<pid>/fd descriptor, the final privilege-escalation step of the public CVE-2026-53362 (Fraggap) exploit chain that triggers root code execution on SIGSEGV.
references:
  - https://access.redhat.com/security/vulnerabilities/RHSB-2026-009
  - https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546
  - attack.t1611
  - attack.t1068
  - cve.2026.53362
  - attack.tool.qwerty_po_exploit
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename: '/proc/sys/kernel/core_pattern'
  selection_payload:
    TargetFilename|contains: 'core_pattern'
  filter_legit:
    CommandLine|contains: 'systemd-coredump'
  condition: selection_path and not filter_legit
falsepositives:
  - Legitimate core-dump handler configuration by systemd-coredump, abrt, or apport during OS provisioning
  - Deliberate administrator reconfiguration of core dump handling
level: critical
```

**Known false positives:**

- systemd-coredump, abrt, or apport legitimately (re)configuring core_pattern during OS install or package update
- Administrator-driven core dump handler changes during incident response or debugging setup

**Tuning notes:** Allowlist the known-good core_pattern values shipped by systemd-coredump/abrt/apport packages on your golden image; any deviation from that allowlist, especially a leading pipe character combined with '/proc/%P/fd/', should page immediately. Correlate with a following SIGSEGV on the same host within seconds to confirm actual exploitation rather than benign reconfiguration.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — core_pattern Crash-Handler Hijack for Root Code Execution (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — Unprivileged Namespace + UDPv6 Corked-Socket Splice Exploit Trigger (locked: unlock with TL Creds)
- CVE-2026-53362 (Fraggap) — Confirmed Container-to-Host Escape: Cross-Namespace Root Process + Post-Escape Host Discovery (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Cyber Security News: CISA Warns of Linux Kernel Privilege Escalation Vulnerability Exploited in Attacks](https://cybersecuritynews.com/linux-kernel-privilege-escalation-vulnerability-exploited/)
- [Red Hat CVE-2026-53362 Security Summary](https://access.redhat.com/security/cve/cve-2026-53362)
- [Red Hat Security Bulletin RHSB-2026-009: IPv6 Fragmentation Container Escape - Linux Kernel (CVE-2026-53362)](https://access.redhat.com/security/vulnerabilities/RHSB-2026-009)
- [Red Hat Bugzilla 2495904 — CVE-2026-53362 kernel: ipv6 frag escape](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-53362)
- [NVD CVE-2026-53362 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53362)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [AlmaLinux: IPV6_FRAG_ESCAPE vulnerability: Fixed!](https://almalinux.org/blog/2026-06-30-ipv6-frag-escape/)
- [TuxCare: The IPv6 Fragmentation Flaw That Breaks Container Isolation Across EL10](https://tuxcare.com/blog/ipv6-frag-escape-cve/)
- [CIQ Knowledge Base: Mitigating IPv6 Frag Escape (CVE-2026-53362) on Rocky Linux 10](https://kb.ciq.com/article/security-advisories/cve-ipv6-frag-escape-mitigation)
- [qwerty: CVE-2026-53362 (Fraggap) Technical Exploitation Writeup](https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/)
- [GitHub: qwerty-po/security-research — CVE-2026-53362 exploit code](https://github.com/qwerty-po/security-research/tree/cve-2026-53362)
- [Red Hat Security Advisory RHSA-2026:34911](https://access.redhat.com/errata/RHSA-2026:34911)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2220