Linux Kernel Unspecified Vulnerability (CVE-2026-53362)

What is affected, what to do

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero.

The vulnerability is being actively exploited; treat it as a priority. Update Linux Kernel to version 6.1.177, Linux Kernel to version 6.6.144, Linux Kernel to version 6.12.95. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Linux Kernel lt 6.0..6.1.177
• Linux Kernel lt 6.2..6.6.144
• Linux Kernel lt 6.7..6.12.95
• Linux Kernel lt 6.13..6.18.38
• Linux Kernel lt 6.19..7.1.3

Fixed in

• Linux Kernel 6.1.177
• Linux Kernel 6.6.144
• Linux Kernel 6.12.95
• Linux Kernel 6.18.38
• Linux Kernel 7.1.3
• Linux Kernel 7.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the kernel patch: upgrade affected branches to 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3 or 7.2. Pull distribution packages (SUSE, Red Hat, Ubuntu, Debian) from the respective vendor advisory and verify with uname -r plus rpm -q kernel or dpkg -l linux-image-*.
   • Schedule reboot windows for all Linux hosts with an active IPv6 stack; drive change tickets off needs-restarting -r or /var/run/reboot-required. Evaluate live-patching (kpatch, kGraft, Ksplice) if downtime is costly — vendor availability per advisory.
   • As a stopgap, disable IPv6 on hosts that do not need it: sysctl -w net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1, persisted in /etc/sysctl.d/. Especially relevant for multi-tenant hosts, container workers and shared-shell systems.
   • Prioritise by attack surface: systems with locally-logged-in unprivileged users (jump hosts, build runners, Kubernetes workers running user workloads, HPC, shared dev VMs) first, then servers with broad SSH access.
   • Restrict unprivileged user namespaces temporarily (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to shrink the exploit primitives available via UDPv6 sockets inside isolated namespaces.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: constrain IPv6 traffic in management and server VLANs via firewall or ip6tables to required flows only. Exploitation is local and does not need external reachability, but reducing IPv6 usage lowers accidental trigger risk.
   • Multi-tenant host hardening: enforce seccomp profiles for containers (Docker, Podman, containerd) that restrict sendmsg/sendmmsg on AF_INET6 with MSG_SPLICE_PAGES and MSG_MORE. Docker's default seccomp profile partially covers this — audit custom profiles.
   • Kubernetes: enforce allowPrivilegeEscalation: false, runAsNonRoot: true and the PodSecurity "restricted" standard. Run pods without IPv6 need with hostNetwork: false and configure the CNI so IPv6 is only enabled on demand.
   • IAM / least privilege: audit local shell access on jump hosts and build runners, remove dormant accounts, tighten AllowUsers/AllowGroups in sshd_config. Every removed local account directly shrinks the exploit surface.
   • Kernel hardening: set kernel.dmesg_restrict=1, kernel.kptr_restrict=2, kernel.yama.ptrace_scope=2 to make follow-up work for a heap overflow exploit (info leaks, debugging) harder.
   • Roll out EDR/AV with Linux kernel-exploit detection modules (Falco, Tracee, CrowdStrike, SentinelOne) on Linux workloads if not already present.
3. 03

   Runbook step 3

   Detection rules

   • Falco/Tracee rule on unusual sendmsg syscalls combining MSG_SPLICE_PAGES (0x8000000) and MSG_MORE (0x8000) on AF_INET6 UDP sockets from unprivileged UIDs. Baseline first, then alert.
   • auditd rule: -a always,exit -F arch=b64 -S socket -F a0=10 -F a1&2 -k ipv6_udp_socket (AF_INET6 = 10, SOCK_DGRAM = 2), correlated with execve of unusual binaries from /tmp, /dev/shm, home directories.
   • Kernel oops / slab corruption in dmesg and /var/log/kern.log: patterns such as "BUG: KASAN", "general protection fault", "slab-out-of-bounds", "corrupted skb_shared_info", stack traces including __ip6_append_data, ip6_append_data, udpv6_sendmsg. Sigma shape:

     detection:
       selection:
         Image: '/var/log/kern.log'
         Message|contains:
           - '__ip6_append_data'
           - 'skb_shared_info'
           - 'slab-out-of-bounds'
     

   • KQL for Defender for Endpoint / Sentinel on Linux telemetry: DeviceEvents | where ActionType == "KernelOops" or AdditionalFields has "ip6_append_data"
   • EDR process ancestry: shells or interpreters (python, perl, gcc, self-compiled binaries) opening UDPv6 sockets right before a kernel oops; child process of an unprivileged user transitioning to UID 0 afterwards (setuid transition in auditd).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Source: Ubuntu Security Notices, NVD (NIST), cvelistv5, Microsoft Security Update Guide, redhat_csaf, CISA KEV Catalog, pwn.watch, suse_csaf, siemens_advisory, Debian Security Advisories, Debian LTS Advisories, BSI WID Portal, BSI CSAF

Vendors and products

• Debian Linux
• Debian Linux-6.1
• Linux Linux
• Linux Linux Kernel
• Siemens Simatic S7
• Siemens Siemens SIMATIC S7-1500 TM MFP Firmware
• Ubuntu Linux-oracle-7.0

Weakness classes (CWE)

• CWE-122Heap-based Buffer Overflow

  Variant

  A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

  Entry at MITRE CWE-122

References & sources

• git.kernel.orgLinux Kernel — CVE-2026-53362pwn-watch
• git.kernel.orgstable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769
• git.kernel.orgstable/c/46f201f8b4c39633a1fa3dc12459f506d470993d
• git.kernel.orgstable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a
• git.kernel.orgstable/c/e9eacf19281ea2498b36291b56c9606118c2d74e
• git.kernel.orgstable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362government-resource
• Siemens ProductCERTproductcert/html/ssa-784472.html
• pwn.watchpwn.watch: Linux Kernel: Linux Kernel Unspecified Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-53362pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 15.10.2026NVD analysis modifiedNVD

   Newly listed as affected:

   • Siemens SIMATIC S7-1500 TM MFP Firmware

   New references:

   • https://cert-portal.siemens.com/productcert/html/ssa-784472.html
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	AND OR *cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*
   Reference type	added	—	siemens-SADP: https://cert-portal.siemens.com/productcert/html/ssa-784472.html Types: Third Party Advisory

   Source identifier: nvd@nist.gov

2. 15.10.2026Record modifiedSiemens ADP

   New references:

   • https://cert-portal.siemens.com/productcert/html/ssa-784472.html
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/53xxx/CVE-2026-53362.json">CVE-2026-53362</a>
   Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-784472.html

   Source identifier: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

3. 28.08.2026NVD analysis modifiedNVD

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362 Types: US Government Resource

   Source identifier: nvd@nist.gov

4. 28.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-53362","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-27T17:44:15.534644Z"}	{"id":"CVE-2026-53362","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-27T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 27.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362
   SSVC assessment	changed	{"id":"CVE-2026-53362","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-27T13:39:31.757563Z"}	{"id":"CVE-2026-53362","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-27T17:44:15.534644Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own SystemsSecurityWeek28.08.2026
• CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation DeadlinesSANS NewsBites28.08.2026