← News
/DISPATCH · 2026-08-28

CVE-2026-53362: Linux Kernel IPv6 Fragment Path OOB Write Lets Local Users Escalate to root

On 27 August 2026, CISA added Linux kernel IPv6 fragment-path OOB write CVE-2026-53362 to the KEV catalog and required federal agencies to patch by 30 August. Kernel rating CVSS v3.1 7.8. Exploit code is circulating. Local low-privilege accounts can escape containers and obtain root.

Incident Overview

On 27 August 2026, CISA added Linux kernel CVE-2026-53362 to the KEV (Known Exploited Vulnerabilities) catalog and required FCEB agencies to patch by 30 August 2026. Kernel.org rating: CVSS v3.1 7.8. Alias: Frag Gap. The CVE was reserved by Linux kernel maintainers to track a long-overlooked fragment-boundary calculation error: `ipv6: account for fraggap on the paged allocation path`.

CVE-2026-53362 hits nearly every major distro—SUSE, Red Hat, Debian, Ubuntu LTS—plus any cloud service or container platform running an affected kernel. A local low-privilege account can trigger an out-of-bounds memory write, escape its container, obtain host root, and pose a systemic threat to virtualization, cloud functions, and CI build nodes that share a kernel.

Technical Details

Root cause

The bug sits in `__ip6_append_data()` in the Linux kernel networking subsystem. When the IPv6 output path takes the paged allocation branch—e.g. `MSG_MORE`, `NETIF_F_SG`, or a large fragment length `fraglen`—the kernel first computes two lengths:

`alloclen = fragheaderlen + transhdrlen;
pagedlen  = datalen    - transhdrlen;
`

The problem: fragheaderlen already includes a "fraggap" slack used to align subsequent fragments. `alloclen` only accounts for the header when allocating pages and does not fold that slack into the paged length. The later copy step `copy = max(datalen - transhdrlen, pagedlen)` overruns the actual allocated page tail into adjacent kernel objects—an OOB write.

Attack vector

Attacker needs only local shell (in-container account, SSH user, or local service account). Write a payload to a local `socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)` with:

Public PoCs (e.g. GitHub repos such as `ekomsSavior/chimera-lpe-chain`) are already circulating in the community. CISA's fast-track is based on a working proof of concept plus attacks observed in the wild.

Impact Assessment

Kernel.org: CVSS v3.1 7.8, vector `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`—local, low complexity, low privilege, no user interaction, full host control. EPSS ranks 30-day exploitation probability higher than 18% of CVEs. Paired with companion CVE-2026-53366 (UDP `MSG_SPLICE_PAGES` fragment-boundary bug), this is a local privilege-escalation and container-escape combo.

Business impact in three layers:

Remediation

Patch now

Detection and alerting

Defense in depth

References