CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published

cve · CVE-2026-53362

Coverage
1
first 2026-08-28 → last 2026-08-30
Latest activity
2026-08-28
A confirmed-exploited Linux kernel local privilege-escalation primitive with no public account of how it is…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, energy, water
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-53362, newest first. Check the date before acting on an older one.

  • Apply the distribution kernel update carrying this stable-tree fix as soon as it is available for every running Linux distribution; CISA's KEV listing confirms active exploitation, and there is no practical configuration-level workaround short of restricting untrusted local users' ability to open raw UDPv6 sockets with MSG_SPLICE_PAGES-capable applications.
    2026-08-28CVE-2026-53362

Defender insights

What each entry about CVE-2026-53362 tells a defender to do, newest first.

2026-08-28NOTABLEexploitedA confirmed-exploited Linux kernel local privilege-escalation primitive with no public account of how it is being used

Triage

Story timeline

  1. 2026-08-28Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published
    trending-vulnerabilitiesA confirmed-exploited Linux kernel local privilege-escalation primitive with no public account of how it is being used

Hunting pivots

Affected products
Linux kernel
Tags
actively-exploitedcisa-kevpriv-escvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-08-28/cve-2026-53362-linux-kernel-ipv6-udp-fraggap-kev · ATT&CK page ↗

Entries about Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published (1)

2026-08-28 · view entry permalink →

NOTABLECVE-2026-53362exploitedupdatedNATOA2

Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27. In __ip6_append_data()'s paged-allocation branch (taken under MSG_MORE / NETIF_F_SG / large-fraglen conditions) alloclen and pagedlen accounting fail to account for a non-zero "fraggap" carried over from a previous skb once transhdrlen is zero, undersizing the linear allocation while overstating pagedlen, so the fraggap-copy step writes past skb->end into the trailing skb_shared_info. The upstream fix commit states the trigger directly: "an unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES" (Linux kernel stable-tree fix commit, 2026-08-27). The bad accounting was introduced by an earlier commit ("ipv6: avoid partial copy for zc") and only became reachable once a later commit allowed MSG_SPLICE_PAGES to proceed in the negative-copy case that previously returned -EINVAL. CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

As of 2026-08-28, no public exploitation narrative, named cluster, or affected-distribution list has been located beyond the KEV/EUVD listing and the upstream kernel commit itself; the flaw is confirmed-exploited per CISA's determination, with the mechanism confirmed against the kernel-tree commit. A local, unprivileged-to-elevated primitive requires an attacker to already hold unprivileged local code execution, exactly the scenario a confirmed kernel LPE turns into full compromise.

Because this affects any Linux kernel exposing an unprivileged user to socket operations (effectively all general-purpose Linux deployments pending distribution backport) the patch lever is the standing kernel-update cycle rather than a configuration change. Triage: none is offered beyond the patch action itself; with no published exploitation narrative, inventing a specific hunting query for this primitive would exceed what the cited sources support. The one available lever short of a distribution backport is restricting which local users or containers can open raw UDPv6 sockets with MSG_SPLICE_PAGES-capable applications, which is not a practical general control for most estates.

An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES.

Linux kernel stable tree (upstream fix commit) 2026-08-27
Correctionrun 2026-08-30T1312Z-auditcvessourcing_notebody

This CVE was recorded as pre-auth, which contradicts the CVSS vector the entry itself quotes: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8. PR:L means the attacker must already hold an unprivileged local account, and the trigger is a local user opening a UDPv6 socket with MSG_MORE and MSG_SPLICE_PAGES set together (upstream kernel fix commit 14200d43). It is a local privilege-escalation primitive, not a remotely reachable one. For scoping, that puts the exposure on hosts where untrusted code already runs, containers, shared shells, CI runners and multi-tenant systems, rather than on the network perimeter.

vulnerability28 Aug 06:02Zmulti-sourceOpen finding →
Sources: Linux kernel stable tree (upstream fix commit) · CISA Known Exploited Vulnerabilities Catalog (JSON feed)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (33%)
  • git.kernel.org1 (33%)
  • github.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)